Executive brief
A vulnerability exists in the Zephyr real-time operating system, which is commonly used in embedded and IoT devices. A flaw in how the system handles network connections can be triggered during the disconnection process, leading to a system crash. This could allow an attacker to disrupt the operations of connected devices, potentially causing service outages or requiring manual reboots.
Technical details
A race condition exists in the Zephyr RTOS TCP implementation within `subsys/net/ip/tcp.c`. When a TCP connection is released via `tcp_conn_release()`, the connection context is cleared; however, incoming packets (specifically SYN packets) may still be processed by `tcp_recv()`. If `tcp_conn_search()` returns NULL because the connection was just removed, the system may derive a NULL pointer from stale context data. This pointer is subsequently passed to `tcp_backlog_is_full()` and dereferenced without validation, resulting in a kernel panic or crash. Exploitation requires the attacker to have low-level network privileges and time the attack to coincide with connection teardown (High Complexity).
Affected products
- Zephyr Project Zephyr OS up to and including 4.3.0
Timeline
- 2026-03-20: other: Embargo date
- 2026-04-05: disclosed
- 2026-04-05: advisory