CVE-2026-10634 Overview
CVE-2026-10634 is a use-after-free vulnerability [CWE-416] in the Zephyr real-time operating system's native TCP stack. The flaw resides in net_tcp_foreach() within subsys/net/ip/tcp.c, which iterates the global connection list using the SYS_SLIST_FOR_EACH_CONTAINER_SAFE macro. The function previously released tcp_lock while invoking the per-connection callback, creating a race window. A concurrent tcp_conn_release() on the TCP work-queue thread can free the cached next connection, causing the iterator to dereference freed slab memory. The defect was introduced with the TCP2 stack in 2020 and affects releases up to and including v4.4.0.
Critical Impact
An adjacent-network attacker triggering TCP connection teardown concurrent with shell or interface-down operations can crash the device or cause callbacks to operate on attacker-influenced reallocated memory.
Affected Products
- Zephyr RTOS native TCP stack (TCP2) — releases through v4.4.0
- subsys/net/ip/tcp.c component using net_tcp_foreach()
- Devices exposing the net conn network shell command or performing interface-down operations
Discovery Timeline
- 2026-06-15 - CVE-2026-10634 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2026-10634
Vulnerability Analysis
The vulnerability is a classic use-after-free race condition in Zephyr's TCP2 stack. net_tcp_foreach() walks the global list of TCP connections using SYS_SLIST_FOR_EACH_CONTAINER_SAFE, a macro that caches a pointer to the next node before invoking the loop body. The original implementation released tcp_lock before calling the per-connection callback and re-acquired it afterward to avoid holding the lock across user code. During that unlocked window, the dedicated TCP work-queue thread can execute tcp_conn_release() when a connection's reference count drops to zero, typically due to a remote peer closing or resetting the connection. That release path removes the connection from the list and returns the underlying memory via k_mem_slab_free(). When the iterator resumes and advances to the cached next pointer, it dereferences freed slab memory.
Root Cause
The root cause is inconsistent locking discipline. tcp_lock was intended to serialize access to the connection list, but the iterator dropped the lock around callback invocation while the release path freed list entries under the lock. The _SAFE iteration variant only protects against removal of the current node by the loop body itself, not against asynchronous removal by another thread.
Attack Vector
The freeing side is driven by ordinary TCP traffic, so an attacker on an adjacent network can reliably trigger tcp_conn_release() by closing or resetting connections. net_tcp_foreach() is reached in production through the net conn network shell command and through net_tcp_close_all_for_iface() invoked on interface-down events. Successful exploitation results in denial of service via crash. If the freed slab slot is reallocated before the iterator dereferences it, the callback operates on an attacker-influenced object, enabling potential information disclosure or further memory corruption.
The vulnerability mechanism is documented in the upstream fix. See GitHub Security Advisory GHSA-6c57-xfhw-j26x for technical details.
Detection Methods for CVE-2026-10634
Indicators of Compromise
- Unexpected kernel faults or system crashes correlated with net conn shell command execution or network interface transitions
- Crash backtraces referencing net_tcp_foreach, tcp_conn_release, or k_mem_slab_free in Zephyr TCP code paths
- Anomalous TCP RST or FIN traffic patterns from adjacent hosts coinciding with administrative network operations
Detection Strategies
- Audit firmware build manifests to enumerate devices running Zephyr versions through v4.4.0 with CONFIG_NET_TCP enabled
- Instrument crash telemetry on embedded fleets to flag faults originating in subsys/net/ip/tcp.c
- Review whether the network shell (CONFIG_NET_SHELL) is enabled in production builds, as it provides the primary trigger path
Monitoring Recommendations
- Collect and centralize device crash dumps with symbolication to identify use-after-free signatures in the TCP stack
- Monitor adjacent-network TCP traffic for unusual reset or close patterns targeting Zephyr-based devices
- Track interface up/down events that invoke net_tcp_close_all_for_iface() against concurrent network activity
How to Mitigate CVE-2026-10634
Immediate Actions Required
- Inventory all Zephyr-based devices and identify firmware images built against TCP2 versions through v4.4.0
- Apply the upstream fix from commit cd85e0e890ab89815c4cbc0a8fbc03a3efa84dc2 and rebuild affected firmware
- Restrict adjacent-network access to embedded devices that cannot be patched immediately
Patch Information
The fix moves the connection and context teardown in tcp_conn_release() inside the tcp_lock critical section and keeps tcp_lock held across the callback invocation in net_tcp_foreach(). This eliminates the race window during which a freed connection could be dereferenced by the iterator. See the Zephyr fix commit for the complete patch.
Workarounds
- Disable CONFIG_NET_SHELL or remove the net conn command from production builds to eliminate the primary user-triggered path
- Avoid administrative interface-down operations on systems with active TCP connections until patched
- Apply network segmentation to prevent untrusted hosts on adjacent networks from initiating or terminating TCP sessions with affected devices
# Configuration example: disable network shell in prj.conf to reduce attack surface
CONFIG_NET_SHELL=n
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
