CVE-2026-10643: Zephyr Out-of-Bounds Write in recvmsg() Buffer Handling

Technical summary

CVE-2026-10643 is an out-of-bounds heap write in Zephyr's IP socket recvmsg() implementation, specifically in the insert_pktinfo() function within subsys/net/lib/sockets/sockets_inet.c. The vulnerability arises from a bounds check that validates only the payload length (msg_controllen < pktinfo_len) without accounting for the cmsg (control message) header alignment. On 64-bit systems, for IPv4 IP_PKTINFO, a control buffer of 16–27 bytes passes the validation but the function writes a complete 28-byte aligned structure, causing an overflow of up to ~12 bytes. Under CONFIG_USERSPACE, the kernel copies and processes the control buffer, leading to kernel heap corruption; in supervisor mode, the caller's stack or heap is overwritten. The exploitable path requires a UDP/IP socket with IP_PKTINFO, IPV6_RECVPKTINFO, or related socket options enabled, and is triggered when recvmsg() is called with an undersized control buffer coinciding with packet arrival. Partial bytes in the overflow (specifically the destination IP field, ipi_addr) are influenced by packet contents.

Business impact

This vulnerability poses a significant risk to Zephyr-based embedded systems and IoT devices. A local unprivileged process can corrupt kernel memory or adjacent application memory, leading to privilege escalation, denial of service, or information disclosure. In resource-constrained embedded deployments, kernel heap corruption may cascade into system instability. Organizations running Zephyr 3.6.0–4.4.0 in multi-tenant or multi-process environments face elevated risk; systems where untrusted local users or applications can create network sockets are directly threatened. Remediation requires timely patching to prevent exploitation in production deployments.

Affected systems

Zephyr RTOS versions 3.6.0 through 4.4.0 are affected. The vulnerability is triggered on systems where local unprivileged code can create UDP/IP sockets with IP_PKTINFO, IPV6_RECVPKTINFO, or equivalent socket options and receive network packets. Embedded devices, IoT platforms, and edge compute systems using the affected Zephyr release are at risk. The vulnerability requires local network access (ability to receive packets), so it is not directly exploitable over the internet but is a critical local privilege escalation vector.

Exploitability

Exploitability is high for local attackers with the ability to create network sockets. The attack does not require elevated privileges; a standard unprivileged user can trigger it by creating a UDP socket, enabling packet information ancillary data, calling recvmsg() with an intentionally small control buffer, and causing a packet to arrive. The timing is non-critical—any matching datagram reliably triggers the write. The overflow is deterministic in size and location, making reliable exploitation feasible. A motivated attacker with local access can use this to corrupt heap metadata, overwrite function pointers, or escalate to kernel-level code execution.

Remediation

Update Zephyr to a patched release version that corrects the bounds check in insert_pktinfo(). The fix modifies the capacity check to use NET_CMSG_SPACE(pktinfo_len), which includes both the aligned cmsg header and the aligned payload, and returns -ENOMEM when the buffer is insufficient. Consult the Zephyr release notes and security advisories to identify the first patched version after 4.4.0. Interim mitigation for unpatched systems includes disabling IP_PKTINFO and related ancillary data options on network sockets if the feature is not required by the application.

Patch guidance

Apply the latest Zephyr patch release that addresses this issue. Verify against the Zephyr security advisory and release notes (typically published after CVE assignment) to confirm the patched version number. Testing should validate that network functionality remains intact post-patch and that ancillary data is correctly handled with various control buffer sizes, including edge cases near the alignment boundary. For production deployments, conduct regression testing on representative hardware and network configurations before rolling out to devices.

Detection guidance

Monitor Zephyr deployments for use of IP_PKTINFO and IPV6_RECVPKTINFO socket options via code review and configuration audit. If the option is not required, disable it. On systems running Zephyr 3.6.0–4.4.0, watch for unexpected kernel panics, memory corruption events, or privilege escalation attempts from unprivileged processes. Kernel memory sanitizers (if available in your build) may catch the heap overflow. Network packet capture and analysis of received datagrams to suspiciously-small control buffers is difficult post-hoc but may assist incident response. Prioritize identifying and upgrading all affected Zephyr instances in your environment.

Why prioritize this

This is a HIGH-severity local privilege escalation with deterministic exploitability and measurable real-world impact. The CVSS 3.1 score of 8.7 reflects high impact on confidentiality, integrity, and availability, combined with low attack complexity and local-only attack vector. While not remotely exploitable, it is trivial for any unprivileged local user to trigger and can yield kernel-level code execution. Organizations with embedded or IoT systems running affected Zephyr versions should treat this as a critical priority; patching should commence immediately post-release availability.

Risk score, explained

CVSS 3.1 assigns a score of 8.7 (HIGH) using the vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:H. The Attack Vector (L) and low Attack Complexity reflect the straightforward local exploitation path. Privileged Require (L) indicates that unprivileged users can trigger the flaw. No User Interaction (N) means the attack is automatic upon packet receipt. The Scope Change (C) acknowledges that kernel-level memory corruption impacts system-wide security. High Integrity and Availability impact reflect the potential for privilege escalation and denial of service. Confidentiality impact is moderate because the overflow may leak adjacent heap contents.

Frequently asked questions