CVE-2026-15924
MediumCVSS 5.9Exploitation Probability (EPSS)
Low risk24th percentile - higher than 24% of all known CVEs
Summary
Zephyr's TLS socket layer (subsys/net/lib/sockets/sockets_tls.c) keeps a process-global client_cache array of cached client session buffers shared by every TLS socket, with access serialized only by the per-socket ctx->lock mutex. Because CONFIG_NET_SOCKETS_TLS_MAX_CLIENT_SESSION_COUNT defaults to 1, two concurrent client sockets contend for the same slot, causing a use-after-free read and a double-free when two saves evict the same entry. This corrupts the mbedTLS heap; the fix adds a dedicated session_cache_lock mutex taken across every accessor of client_cache.
Risk Assessment
Exploitation requires an application that opts into the TLS_SESSION_CACHE socket option (off by default) and runs concurrent TLS client connections on multiple threads. A malicious or compromised server can raise session-ticket frequency to widen the race window, leading to a crash or heap corruption (denial of service).
Recommendation
Update Zephyr to a version containing the fix that adds the session_cache_lock mutex. If updating is not possible, disable the TLS_SESSION_CACHE socket option or avoid concurrent multi-threaded TLS client connections with session caching.
Other vulnerabilities in Zephyr
See all- CVE-2026-10772Unknown
This CVE has been rejected as a duplicate. The described vulnerability involved incorrect permission checking in the Bluetooth GATT notify/indicate paths in the Zephyr stack, but was already reported as CVE-2026-2411.
- CVE-2026-10676Unknown
CVE-2026-10676 has been withdrawn as analysis determined that the reported defect is not reachable in any released version of Zephyr. In every supported release, the affected value is corrected before use.
- CVE-2026-5067Critical
Zephyr OS has a memory corruption vulnerability in the HTTP server WebSocket upgrade path. An unauthenticated remote attacker can trigger it by sending a crafted Sec-WebSocket-Key header. The bounded copy does not guarantee NUL termination, leading to out-of-bounds read/write on stack.
- CVE-2026-19673High
A vulnerability in ethernet_recv() in subsys/net/l2/ethernet/ethernet.c in the Zephyr network stack. When the ethertype is 0x8100 and VLAN is enabled on the interface, the received frame buffer is reinterpreted as an 18-byte net_eth_vlan_hdr without re-checking the length, causing an out-of-bounds read and raising hdr_len to 18. A single unauthenticated frame of 14 to 17 bytes carrying the VLAN ethertype triggers the issue.
- CVE-2026-19935High
A vulnerability in the Zephyr Bluetooth LE stack allows a remote, unauthenticated attacker to trigger a use-after-free in L2CAP CoC channel handling with dynamic PSMs. By sending a data frame followed by a disconnect request, the attacker can cause the system workqueue to process work referencing a freed channel, leading to memory corruption or workqueue corruption.
- CVE-2026-19740Medium
The LLCP implementation in Zephyr's Bluetooth LE Controller retains a receive node after accepting LL_PHY_UPDATE_IND, but invalid-PDU paths fail to release it before completing the procedure. An attacker can send a PDU sequence causing an assertion failure (device crash) or leaking nodes from the receive pool, leading to Bluetooth unavailability until reboot.
- CVE-2026-19669High
A vulnerability in Zephyr's syscall verifiers z_vrfy_fuel_gauge_get_props() and z_vrfy_fuel_gauge_set_props() allocates variable-length arrays on the kernel stack sized directly by an unvalidated caller-supplied len argument. Because no bounds check occurs before allocation and copying, a user-mode thread (with CONFIG_USERSPACE) can trigger an out-of-bounds write in supervisor mode with attacker-controlled length and, on the permitted path, attacker-controlled content.
- CVE-2026-19577High
An out-of-bounds read vulnerability was found in the IPv6 subsystem of the Zephyr stack in net_route_ipv6_packet(). The issue stems from missing validation of whether a neighbor cache entry has a link-layer address before using it. An attacker on the same link can force an unresolved neighbor state and trigger an out-of-bounds read past the address array, potentially causing a system panic or data leak.
- CVE-2026-19186High
In the IEEE 802.15.4 stack in Zephyr, the function ieee802154_decipher_data_frame() does not check if the frame is long enough before computing the payload length. Subtracting the header and authentication tag length from the frame length can underflow, leading to an out-of-bounds read and write. An attacker within radio range can send a short frame, causing memory corruption and system crash.
- CVE-2026-18415Medium
The ieee802154_send() function in Zephyr's network stack copies an outgoing packet into a fixed 125-byte transmit buffer without validating its length. When 6LoWPAN fragmentation is enabled but not required, the missing size check allows an out-of-bounds write past the buffer. The flaw is reachable through NET_AF_PACKET sockets bound to an 802.15.4 interface, including from an unprivileged application thread in CONFIG_USERSPACE builds.
Original NVD description (English source)
Zephyr's TLS socket layer in subsys/net/lib/sockets/sockets_tls.c keeps a single process-global array, client_cache, of cached client sessions that is shared by every TLS socket context. The functions that mutate and read it — tls_session_save(), tls_session_get(), tls_session_cache_reset(), and the settings restore handler — allocate, free, and dereference each entry's heap buffer (entry->session). Before the fix these accesses were serialized only by the per-socket context mutex ctx->lock (assigned per socket in ctx_set_lock()), which provides no mutual exclusion between different sockets touching the shared cache. Because CONFIG_NET_SOCKETS_TLS_MAX_CLIENT_SESSION_COUNT defaults to 1, any two concurrent client sockets contend for the same slot. A thread in tls_session_get() reading entry->session inside mbedtls_ssl_session_load() can run concurrently with another thread in tls_session_save() that selects the same entry for reuse and executes mbedtls_free(entry->session) before reallocating — a use-after-free read, and a double-free when two saves evict the same entry. Both corrupt the mbedTLS heap. The cache is reached on ordinary client paths: at connect time via tls_session_store()/tls_session_restore(), and (on main) whenever a TLS 1.3 session ticket arrives during recv()/poll() via tls_session_store_current(). Exploitation requires an application that opts into per-socket client session caching (the TLS_SESSION_CACHE socket option, off by default) and runs concurrent TLS client connections on multiple threads; the timing that opens the window is influenced by the remote peer(s), so a malicious or compromised server can raise session-ticket frequency to widen it. The reliably-demonstrable impact is memory corruption leading to a crash or heap corruption (denial of service). The fix adds a dedicated session_cache_lock mutex taken across every accessor of client_cache, serializing all reads and frees and closing the race.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS