CVE-2026-10634: Zephyr TCP Stack Use-After-Free Race Condition

Technical summary

CVE-2026-10634 is a use-after-free vulnerability in net_tcp_foreach() (subsys/net/ip/tcp.c) of Zephyr's TCP2 stack. The function iterates a global connection list using SYS_SLIST_FOR_EACH_CONTAINER_SAFE, which caches the next node pointer. Before the fix, tcp_lock was released during per-connection callback execution and re-acquired afterward. A concurrent tcp_conn_release() running on the dedicated TCP work-queue thread can remove and free the cached next connection object during this window. When the iterator resumes, it dereferences freed slab memory—a classic use-after-free. If the slab slot is reused before the dereference, the callback operates on attacker-influenced data. The vulnerability is reachable via the net conn shell command and net_tcp_close_all_for_iface() (invoked on interface-down events), with the freeing triggered by ordinary TCP traffic or connection termination.

Business impact

This vulnerability primarily affects Zephyr-based IoT and embedded devices in network-connected deployments. The denial of service impact can cause critical infrastructure, industrial controllers, medical devices, or consumer IoT products to crash unexpectedly. Information disclosure, if triggered, could expose session state or internal kernel memory. For organizations deploying Zephyr in safety-critical or high-availability environments, unplanned system crashes introduce operational risk and potential compliance violations. The local network access requirement narrows the attack surface to insider threats, compromised adjacent devices, or environments where untrusted nodes can join the network segment.

Affected systems

Zephyr releases up to and including v4.4.0 are affected. The defect was introduced with the modern TCP2 stack implementation in 2020. Any device or application running Zephyr with the native TCP stack enabled and exposed to local network traffic is potentially vulnerable. This includes IoT gateways, edge controllers, wireless mesh nodes, and embedded systems that rely on Zephyr's networking stack. Version v4.4.1 and later contain the fix; versions prior to 2020 (before TCP2) are not affected due to use of a different stack implementation.

Exploitability

Exploitation requires local network access (AV:A) and limited privileges (PR:L), making this a moderate-complexity attack. The attacker must induce concurrent TCP events—typically by initiating or terminating connections while triggering net_tcp_foreach() via the shell command or by downing an interface. The race condition is timing-dependent (AC:H) and not trivial to trigger reliably. However, the attack does not require user interaction (UI:N), and once triggered, the outcome is deterministic: either a crash or memory access on attacker-controlled data. The vulnerability does not yet appear on CISA's KEV catalog, indicating limited evidence of active exploitation in the wild.

Remediation

Upgrade Zephyr to v4.4.1 or later, which includes the fix that moves tcp_conn_release() teardown logic inside the tcp_lock critical section and maintains the lock across callbacks in net_tcp_foreach(). Organizations unable to upgrade immediately should implement network segmentation to restrict local network access to trusted devices only, disable the net conn shell command in production builds, and monitor for unexpected TCP stack crashes or anomalous memory access patterns. Consider running Zephyr applications with minimal privileges and applying static analysis tools to identify other potential race conditions in the codebase.

Patch guidance

Apply Zephyr v4.4.1 or later. Verify the fix by confirming that tcp_lock is held throughout net_tcp_foreach() and that tcp_conn_release() no longer frees connection state outside the critical section. Organizations managing custom Zephyr builds should cherry-pick the fix commit from the upstream repository if immediate version upgrade is not feasible. Test the patched build against your specific TCP workload (connection churn, interface transitions, shell commands) to ensure stability. After patching, monitor system logs for TCP-related faults or unexpected resets to confirm the race condition is resolved.

Detection guidance

Monitor for kernel crashes, panics, or unexpected TCP stack faults, particularly those involving memory access violations or heap corruption. Enable kernel memory protections (CONFIG_HEAP_MEM_POOL_SIZE, CONFIG_DEBUG_MEMORY_HEAP) in development to catch use-after-free earlier. Use Zephyr's network shell (net conn list) in a loop while simultaneously inducing connection state changes—if the system crashes or behaves erratically under this load, the vulnerability may be present. ASAN (Address Sanitizer) or similar runtime analysis tools, if available in your Zephyr build, will flag use-after-free. Baseline your system's stability with known-good builds, then compare behavior after patching to confirm mitigation.

Why prioritize this

Although CVSS score is moderate (4.8), this vulnerability warrants prompt attention because it affects embedded and IoT devices where denial of service and information disclosure are high-impact. The root cause—a classic race condition in core network infrastructure—indicates potential for similar bugs elsewhere in the stack. The local-only requirement reduces the threat vector in most IoT deployments, but in shared network environments (mesh networks, edge gateways, industrial controllers) the risk is elevated. Prioritize patches for customer-facing or safety-critical deployments first; defer for isolated or air-gapped systems if internal resources are constrained.

Risk score, explained

The CVSS v3.1 score of 4.8 (MEDIUM) reflects: limited attack vector (adjacent network only, AV:A), modest complexity to exploit (AC:H, race condition timing), and requirement for user privileges (PR:L). However, the impact is significant—high availability loss via crash (A:H)—balanced by no confidentiality or integrity impact in most scenarios. The use-after-free could theoretically enable information disclosure or further fault if memory is reused, which the CVSS vector does not fully capture. In practice, the score appropriately reflects a moderate risk that demands patching but is not an emergency in low-risk network environments.

Frequently asked questions