# CVE-2026-19735: Zephyr TCP ISN derivation with all-zero key on entropy failure

Source: https://junglewise.ai/threats/cve-2026-19735-the-rfc-6528-initial-sequence-number-implementation-in-subsys-net  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-11. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-19735 · Severity: medium · CVSS 4.8 · Published 2026-10-11

Zephyr RTOS uses a cryptographic function to generate TCP initial sequence numbers (ISNs) that are supposed to be unpredictable to prevent connection spoofing attacks. However, if the system's random number generator fails during boot—which can happen when hardware entropy devices are still initializing—the code silently falls back to an all-zero key instead of retrying or logging the error. An attacker can then predict ISNs for any TCP connection to the device, enabling blind spoofing and data injection attacks.

Technologies: [Zephyr RTOS](https://junglewise.ai/threats/technologies/rtos). Vendors: [Zephyr](https://junglewise.ai/threats/vendors/zephyr).

## Quick answers

**Is CVE-2026-19735 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-19735 being exploited in the wild.

**How severe is CVE-2026-19735?** Medium severity, with a CVSS score of 4.8, published 11 October 2026.

**Which products and versions are affected?** Zephyr RTOS unknown.

**Is there a fix for CVE-2026-19735?** Yes: fixed in Fix moves key generation into a guarded helper that latches only on success and falls back to sys_rand32_get() on failure.. Until then: Ensure the entropy driver is initialized before TCP connections are accepted, or disable CONFIG_NET_TCP_ISN_RFC6528 to use the fallback sys_rand32_get() implementation instead. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-19735 attacked?** It is attacked over the network, in an operating system.

**Am I affected by CVE-2026-19735?** Check whether you run Zephyr RTOS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in Fix moves key generation into a guarded helper that latches only on success and falls back to sys_rand32_get() on failure.

Ensure the entropy driver is initialized before TCP connections are accepted, or disable CONFIG_NET_TCP_ISN_RFC6528 to use the fallback sys_rand32_get() implementation instead.

## Technical details

The RFC 6528 ISN implementation in subsys/net/ip/tcp.c fails silently when sys_csrand_get() returns an error during key initialization, leaving a 128-bit unique_key as all zeros and latching the initialization guard to prevent retries. With a zero key, ISNs become a deterministic function of the connection four-tuple and a device-wide time offset; an attacker observing a single ISN can recover the offset and predict ISNs for other connections. The vulnerability requires the entropy driver to fail at or before the first TCP connection, which is possible during early boot when hardware RNG devices are still gathering entropy.

## Affected products

- Zephyr RTOS unknown

## Timeline

- 2026-10-11: disclosed

## Related threats

- [Zephyr Bluetooth HCI USB buffer overflow in controller-to-host path](https://junglewise.ai/threats/cve-2026-79982-the-bluetooth-hci-usb-transport-class-of-the-new-usb-device-stack)
- [Zephyr RTOS PECI driver privilege escalation in peci_transfer()](https://junglewise.ai/threats/cve-2026-19676-the-user-mode-verifier-for-the-peci-transfer-system-call-z-vrfy)
- [Zephyr Bluetooth host ATT buffer use-after-free in signed write path](https://junglewise.ai/threats/cve-2026-19938-the-bluetooth-host-s-att-transmit-path-releases-a-buffer-it-does)
- [Zephyr Bluetooth Mesh Access layer delayable message context leak](https://junglewise.ai/threats/cve-2026-19937-the-bluetooth-mesh-access-layer-delayable-message-machinery-in)
- [Zephyr RTOS IEEE 802.15.4 integer underflow in frame decryption](https://junglewise.ai/threats/cve-2026-19186-ieee802154-decipher-data-frame-in-subsys-net-l2-ieee802154)