CVE-2026-102808: PX4 Autopilot Use-After-Free Vulnerability

CVE-2026-102808 Overview

CVE-2026-102808 is a NULL pointer dereference vulnerability [CWE-476] in PX4 Autopilot through version 1.17.0. The flaw resides in the sd_stress system command, where the -b byte count parameter is parsed without validation before being passed to malloc() and memset(). When malloc() returns NULL for an invalid or excessive allocation size, the subsequent memset() call writes to a NULL pointer, crashing the flight controller process. Attackers with shell access, including through the MAVLink protocol, can trigger the crash by supplying crafted byte count values.

Critical Impact
An adjacent-network attacker with MAVLink shell access can crash the PX4 flight controller during operation, disrupting availability of the autopilot on unmanned aerial vehicles.

Affected Products

PX4 Autopilot versions up to and including 1.17.0
Flight controllers running the vulnerable sd_stress system command
UAV platforms exposing MAVLink shell access

Discovery Timeline

2026-09-29 - CVE CVE-2026-102808 published to NVD
2026-09-29 - Last updated in NVD database

Technical Details for CVE-2026-102808

Vulnerability Analysis

The sd_stress command in PX4 Autopilot performs SD card stress testing by allocating a buffer of user-specified size and writing test patterns to storage. The command accepts a -b argument declaring the number of bytes per operation. The parser accepts the raw integer without enforcing the intended 1-10000 range documented in the usage help.

When the requested allocation fails or an invalid value is supplied, malloc() returns NULL. The command does not check the return value before calling memset() on the resulting pointer. The write to address zero triggers a fault in the flight controller task, taking down critical autopilot functionality.

The vulnerability sits in src/systemcmds/sd_stress/sd_stress.cpp. Reference the PX4 vulnerable source region for the affected code path.

Root Cause

The root cause is missing input validation on the -b byte count parameter combined with an unchecked malloc() return value. The parser trusts attacker-controlled numeric input and passes it directly to memory allocation. Neither range checking nor NULL-pointer verification is applied before the buffer is written.

Attack Vector

Exploitation requires shell access to the PX4 system console. This access can be obtained locally or remotely over MAVLink, which is commonly exposed to ground control stations across radio or IP links. An attacker on the same adjacent network issues an sd_stress -b <value> command with a value that causes allocation failure. The resulting NULL write halts the flight controller.

cpp

// Patch: src/systemcmds/sd_stress/sd_stress.cpp
// Commit c865dc9fde14d1391916775153aa271603c3c592

	PRINT_MODULE_USAGE_NAME_SIMPLE("sd_stress", "command");
	PRINT_MODULE_USAGE_PARAM_INT('r', 5, 1, 10000, "Number of runs", true);
-	PRINT_MODULE_USAGE_PARAM_INT('b', 100, 1, 10000, "Number of bytes", true);
+	PRINT_MODULE_USAGE_PARAM_INT('b', 100, 1, 10000, "Number of bytes (1-10000)", true);
}

static bool create_dir(const char *path)
// Source: https://github.com/PX4/PX4-Autopilot/commit/c865dc9fde14d1391916775153aa271603c3c592

The upstream patch clarifies the documented range for the -b parameter as part of the fix delivered in pull request #28795.

Detection Methods for CVE-2026-102808

Indicators of Compromise

Unexpected termination or watchdog reset of the PX4 flight controller task during flight or bench testing
MAVLink shell session logs containing sd_stress invocations with unusual -b values
Repeated autopilot reboots correlated with ground control station shell activity

Detection Strategies

Inspect MAVLink telemetry and shell command logs for use of the sd_stress command from non-administrative endpoints
Monitor PX4 boot logs and dmesg-equivalent output for NULL pointer fault traces originating in sd_stress.cpp
Correlate flight controller crash events with recent network activity on MAVLink ports

Monitoring Recommendations

Enable MAVLink authentication and log all shell commands issued to onboard autopilots
Alert on any invocation of diagnostic system commands (sd_stress, sd_bench, hardfault_log) during operational flights
Track firmware version inventory across UAV fleets to identify units running PX4 1.17.0 or earlier

How to Mitigate CVE-2026-102808

Immediate Actions Required

Upgrade PX4 Autopilot to a build that includes commit c865dc9fde14d1391916775153aa271603c3c592 from pull request #28795
Restrict MAVLink shell access to trusted operators and authenticated ground control stations only
Disable exposed MAVLink endpoints on production airframes where shell access is not required

Patch Information

The fix is available in the PX4 Autopilot repository via commit c865dc9fde14d1391916775153aa271603c3c592. Refer to the PX4 Autopilot commit log and the VulnCheck security advisory for details. Rebuild firmware from a patched source tree and deploy to affected airframes.

Workarounds

Remove or disable the sd_stress module in custom PX4 firmware builds if the command is not required
Segment the MAVLink control link on a dedicated radio or VLAN and require mutual authentication between the vehicle and ground station
Implement operator-side command filtering that blocks sd_stress invocations from reaching the vehicle

bash

# Rebuild PX4 firmware from a patched source tree
git clone https://github.com/PX4/PX4-Autopilot.git
cd PX4-Autopilot
git checkout c865dc9fde14d1391916775153aa271603c3c592
make px4_fmu-v5_default