CVE-2026-8718
HighCVSS 8.4Exploitation Probability (EPSS)
Low risk2th percentile - higher than 2% of all known CVEs
Summary
A vulnerability in tls_opt_dtls_peer_connection_id_value_get() in Zephyr (subsys/net/lib/sockets/sockets_tls.c) causes an out-of-bounds write in the kernel. The function passes the caller-supplied optval directly to mbedtls_ssl_get_peer_cid() without verifying the buffer is at least MBEDTLS_SSL_CID_OUT_LEN_MAX (default 32) bytes. In CONFIG_USERSPACE builds, an unprivileged thread can trigger a kernel buffer overflow by passing a small optlen on a connected DTLS socket with Connection ID enabled.
Risk Assessment
An unprivileged user can cause a kernel buffer overflow, potentially leading to system instability or privilege escalation.
Recommendation
It is recommended to apply the fix that rejects callers with optlen below MBEDTLS_SSL_CID_OUT_LEN_MAX and update the system to a patched version.
Original NVD description (English source)
tls_opt_dtls_peer_connection_id_value_get() in subsys/net/lib/sockets/sockets_tls.c, which handles getsockopt(SOL_TLS, TLS_DTLS_PEER_CID_VALUE), passed the caller-supplied optval directly to mbedtls_ssl_get_peer_cid() without verifying the buffer was at least MBEDTLS_SSL_CID_OUT_LEN_MAX (default 32) bytes. mbedtls_ssl_get_peer_cid() copies the peer-negotiated DTLS Connection ID (length 1..MBEDTLS_SSL_CID_OUT_LEN_MAX) into that buffer without a destination-size parameter, so a caller-supplied optlen smaller than the CID causes a write of up to 31 bytes past the buffer end. In CONFIG_USERSPACE builds the getsockopt syscall verifier (z_vrfy_zsock_getsockopt) bounce-buffers the user's optval into a kernel allocation of exactly optlen bytes (k_usermode_alloc_from_copy -> z_thread_malloc), so an unprivileged user thread that passes a small optlen on a connected DTLS socket with Connection ID enabled induces a kernel-heap buffer overflow, with the overflowing content being the remote peer's CID. The defect requires CONFIG_MBEDTLS_SSL_DTLS_CONNECTION_ID, an established DTLS session with a negotiated peer CID, and (for the kernel-crossing case) CONFIG_USERSPACE. Introduced when the TLS_DTLS_CID option was added (v3.5.0). The fix rejects callers whose optlen is below MBEDTLS_SSL_CID_OUT_LEN_MAX with -EINVAL.