# CVE-2026-18417: Zephyr RTOS BSD socket layer type confusion

Source: https://junglewise.ai/threats/cve-2026-18417-the-native-bsd-socket-layer-recorded-a-pending-asynchronous  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-29. Updated: 2026-09-29  
License: CC BY 4.0 with a link back

CVE-2026-18417 · Severity: medium · CVSS 6.5 · Published 2026-09-29

Zephyr RTOS's BSD socket implementation stores error codes in a shared data field that is also used by the network stack to pass context pointers. When a listening TCP socket's network interface goes down repeatedly, the stale error code can be dereferenced as a pointer, causing the kernel to crash. An attacker with local access or the ability to repeatedly trigger link-down events (such as disrupting a wireless link) can force a system reboot.

Vendors: [Nordic Semiconductor](https://junglewise.ai/threats/vendors/nordic-semiconductor).

## Quick answers

**Is CVE-2026-18417 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-18417 being exploited in the wild.

**How severe is CVE-2026-18417?** Medium severity, with a CVSS score of 6.5, published 29 September 2026.

**Which products and versions are affected?** Nordic Semiconductor Zephyr RTOS v4.3.0, v4.3.1, v4.4.x.

**Is there a fix for CVE-2026-18417?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-18417 attacked?** It is attacked with local access or from the adjacent network, in an operating system.

**Am I affected by CVE-2026-18417?** Check whether you run Nordic Semiconductor Zephyr RTOS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A type-punning vulnerability in the BSD socket layer (subsys/net/lib/sockets/sockets_inet.c) stores asynchronous socket errors as integers in struct net_context's void user_data field, which is normally owned by the network stack to hold context pointers for TCP accept callbacks. On v4.3.0, a second interface-down event reuses the poisoned field, causing zsock_accepted_cb() to dereference a small errno value as a struct pointer, performing arbitrary stores through the corrupted address. Later versions (v4.3.1+) disarm the callback but leave a narrower race condition and allow getsockopt(SO_ERROR) to leak kernel addresses to userspace.

## Affected products

- Nordic Semiconductor Zephyr RTOS v4.3.0, v4.3.1, v4.4.x

## Timeline

- 2026-09-29: disclosed

## Related threats

- [Zephyr kernel device_deinit() privilege escalation via type confusion](https://junglewise.ai/threats/cve-2026-19575-the-user-mode-verification-handler-for-the-device-deinit-system)