CVE-2026-15924
MediumCVSS 5.9Exploitation Probability (EPSS)
Low risk24th percentile - higher than 24% of all known CVEs
Summary
Zephyr's TLS socket layer (subsys/net/lib/sockets/sockets_tls.c) keeps a process-global client_cache array of cached client session buffers shared by every TLS socket, with access serialized only by the per-socket ctx->lock mutex. Because CONFIG_NET_SOCKETS_TLS_MAX_CLIENT_SESSION_COUNT defaults to 1, two concurrent client sockets contend for the same slot, causing a use-after-free read and a double-free when two saves evict the same entry. This corrupts the mbedTLS heap; the fix adds a dedicated session_cache_lock mutex taken across every accessor of client_cache.
Risk Assessment
Exploitation requires an application that opts into the TLS_SESSION_CACHE socket option (off by default) and runs concurrent TLS client connections on multiple threads. A malicious or compromised server can raise session-ticket frequency to widen the race window, leading to a crash or heap corruption (denial of service).
Recommendation
Update Zephyr to a version containing the fix that adds the session_cache_lock mutex. If updating is not possible, disable the TLS_SESSION_CACHE socket option or avoid concurrent multi-threaded TLS client connections with session caching.
Other vulnerabilities in Zephyr
See all- CVE-2026-10772Unknown
This CVE has been rejected as a duplicate. The described vulnerability involved incorrect permission checking in the Bluetooth GATT notify/indicate paths in the Zephyr stack, but was already reported as CVE-2026-2411.
- CVE-2026-10676Unknown
CVE-2026-10676 has been withdrawn as analysis determined that the reported defect is not reachable in any released version of Zephyr. In every supported release, the affected value is corrected before use.
- CVE-2026-5067Critical
Zephyr OS has a memory corruption vulnerability in the HTTP server WebSocket upgrade path. An unauthenticated remote attacker can trigger it by sending a crafted Sec-WebSocket-Key header. The bounded copy does not guarantee NUL termination, leading to out-of-bounds read/write on stack.
- CVE-2026-15890Medium
A vulnerability in the PSA Internal Trusted Storage module in Zephyr involves a lack of synchronization in nonce generation for AEAD encryption. The function secure_storage_its_transform_aead_get_nonce() uses unsynchronized function-local static variables, and concurrent writes to the same UID can lead to nonce reuse with the same key. This causes a catastrophic AEAD failure, enabling data leakage and forgery of stored entries.
- CVE-2026-17050Medium
The experimental USB host stack in Zephyr contains a double-free vulnerability in the configuration descriptor buffer. On three error paths, the buffer is freed but the pointer is left dangling, leading to a second free during cleanup. The vulnerability can be triggered by a malicious or malformed USB device.
- CVE-2026-16515Medium
The net_icmpv6_send_error() function in the Zephyr network stack implemented only one of the three RFC 4443 section 2.4 suppression rules, so it did not check whether the packet's source address identifies a single node or whether the packet was sent to a multicast destination. An unauthenticated attacker on the same link can send a single IPv6 packet to ff02::1 with a spoofed victim source, causing every Zephyr node to emit ICMPv6 Parameter Problem messages to that victim (reflection with amplification), or send a unicast packet with a multicast source address, turning it into a link-flooding multicast frame.
- CVE-2026-15923Medium
The Zephyr SDIO subsystem has a vulnerability in sdio_io_rw_extended_helper() where func->cis.max_blk_size is decoded from the SDIO card without validation. If a card reports a maximum block size of zero, the transfer loop never terminates, causing a thread hang and permanent mutex lock, leading to denial of service for the SDIO peripheral.
- CVE-2026-15460Medium
A vulnerability in the Bluetooth Classic (BR/EDR) stack in Zephyr RTOS affects the L2CAP receive handler, which dispatches inbound data PDUs based only on the destination channel ID without verifying that the channel has reached the BT_L2CAP_CONNECTED state. An attacker within radio range can send data to a channel during connection setup, before configuration and authentication complete. This can lead to delivery of attacker data to upper-layer protocols on a half-open channel and to use of stale or partially initialized channel state, causing denial of service or a potential dangling-pointer condition.
- CVE-2026-14697Medium
In the IPv6 subsystem of the Zephyr stack (subsys/net/ip/ipv6_nbr.c), the net_ipv6_send_ns() function allocates a transmit net_pkt for a Neighbor Solicitation. When called with a data packet pending on an unresolved neighbor and the neighbor's pending_queue is already non-empty, the function appends the data packet and returns early without sending the NS via net_send_data() or releasing it with net_pkt_unref(). The freshly allocated NS net_pkt and its attached TX buffers are held only by a local variable and are leaked permanently, never returning to CONFIG_NET_PKT_TX_COUNT / CONFIG_NET_BUF_TX_COUNT.
- CVE-2026-13735Low
Zephyr's WireGuard implementation mishandled keepalive packets. A type-4 message with a 16-byte payload (empty plaintext plus Poly1305 tag) was accepted without tag verification because wg_process_data_message() returned early before calling wg_decrypt_packet(). An attacker could send a forged keepalive without knowing the session key.
Original NVD description (English source)
Zephyr's TLS socket layer in subsys/net/lib/sockets/sockets_tls.c keeps a single process-global array, client_cache, of cached client sessions that is shared by every TLS socket context. The functions that mutate and read it — tls_session_save(), tls_session_get(), tls_session_cache_reset(), and the settings restore handler — allocate, free, and dereference each entry's heap buffer (entry->session). Before the fix these accesses were serialized only by the per-socket context mutex ctx->lock (assigned per socket in ctx_set_lock()), which provides no mutual exclusion between different sockets touching the shared cache. Because CONFIG_NET_SOCKETS_TLS_MAX_CLIENT_SESSION_COUNT defaults to 1, any two concurrent client sockets contend for the same slot. A thread in tls_session_get() reading entry->session inside mbedtls_ssl_session_load() can run concurrently with another thread in tls_session_save() that selects the same entry for reuse and executes mbedtls_free(entry->session) before reallocating — a use-after-free read, and a double-free when two saves evict the same entry. Both corrupt the mbedTLS heap. The cache is reached on ordinary client paths: at connect time via tls_session_store()/tls_session_restore(), and (on main) whenever a TLS 1.3 session ticket arrives during recv()/poll() via tls_session_store_current(). Exploitation requires an application that opts into per-socket client session caching (the TLS_SESSION_CACHE socket option, off by default) and runs concurrent TLS client connections on multiple threads; the timing that opens the window is influenced by the remote peer(s), so a malicious or compromised server can raise session-ticket frequency to widen it. The reliably-demonstrable impact is memory corruption leading to a crash or heap corruption (denial of service). The fix adds a dedicated session_cache_lock mutex taken across every accessor of client_cache, serializing all reads and frees and closing the race.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS