CVE-2026-10643: Zephyr IP Socket Buffer Overflow Vulnerability

CVE-2026-10643 Overview

CVE-2026-10643 is an out-of-bounds write vulnerability [CWE-787] in the Zephyr real-time operating system's IP socket recvmsg() implementation. The flaw resides in insert_pktinfo() within subsys/net/lib/sockets/sockets_inet.c, where the ancillary control buffer capacity check omits the cmsghdr size. An unprivileged userspace thread can trigger a fixed-size overflow of up to one cmsg header past the end of a kernel-heap buffer when CONFIG_USERSPACE is enabled. The affected code path is reachable via UDP/IP sockets with IP_PKTINFO, IPV6_RECVPKTINFO, hoplimit, or timestamping options enabled. Zephyr versions v3.6.0 through v4.4.0 are affected.

Critical Impact
An unprivileged userspace thread can corrupt kernel heap memory via a crafted recvmsg() call with an undersized control buffer, with portions of the overwritten bytes influenced by attacker-controllable packet data.

Affected Products

Zephyr RTOS v3.6.0 through v4.4.0
Applications using UDP/IP sockets with IP_PKTINFO enabled
Applications using IPV6_RECVPKTINFO, hoplimit, or timestamping ancillary options

Discovery Timeline

2026-06-28 - CVE-2026-10643 published to NVD
2026-06-29 - Last updated in NVD database

Technical Details for CVE-2026-10643

Vulnerability Analysis

The vulnerability stems from an incorrect capacity check in insert_pktinfo(). The function validated the user-supplied msg_control buffer using only the payload length via msg->msg_controllen < pktinfo_len. This check omitted the aligned cmsg header size that insert_pktinfo() actually writes.

For IPv4 IP_PKTINFO on a 64-bit target, a complete cmsg element occupies 28 bytes, while the payload alone is 12 bytes. A control buffer sized between 16 and 27 bytes passes the guard but triggers a fixed-size out-of-bounds write of up to one cmsg header (approximately 12 bytes) past the buffer end.

When CONFIG_USERSPACE is enabled, the recvmsg verifier allocates a kernel-heap copy of the control buffer sized to msg_controllen and executes the implementation against that copy. The overflow therefore corrupts kernel heap memory from an unprivileged userspace thread. In supervisor mode, the overflow corrupts the caller's own buffer.

Root Cause

The capacity comparison used the raw payload length rather than the total space required for an aligned cmsg entry. The correct calculation is NET_CMSG_SPACE(pktinfo_len), which accounts for both the aligned header and aligned data. The mismatch between the size validated and the size written created the under-checked window.

Attack Vector

An unprivileged local userspace thread opens a UDP/IP socket, enables IP_PKTINFO or IPV6_RECVPKTINFO, and calls recvmsg() with a deliberately undersized control buffer. When a datagram arrives, insert_pktinfo() writes past the buffer end onto the kernel heap. Part of the overwritten bytes corresponds to ipi_addr (the destination IP), which is influenced by the received packet, giving the attacker partial control over the corrupted content.

// Patch from subsys/net/lib/sockets/sockets_inet.c
			  void *pktinfo, size_t pktinfo_len)
 {
 	struct net_cmsghdr *cmsg;
+	size_t cmsg_space = NET_CMSG_SPACE(pktinfo_len);
 
-	if (msg->msg_controllen < pktinfo_len) {
-		return -EINVAL;
+	if (msg->msg_controllen < cmsg_space) {
+		return -ENOMEM;
 	}
 
 	for (cmsg = NET_CMSG_FIRSTHDR(msg); cmsg != NULL; cmsg = NET_CMSG_NXTHDR(msg, cmsg)) {

Source: Zephyr Project commit 01fe77b

The patch replaces the undersized comparison with NET_CMSG_SPACE(pktinfo_len) and returns -ENOMEM instead of -EINVAL when the buffer is too small.

Detection Methods for CVE-2026-10643

Indicators of Compromise

Unexpected kernel heap corruption or panics on Zephyr devices with networking enabled
Userspace applications invoking recvmsg() with msg_controllen values between 16 and 27 bytes on 64-bit targets
UDP sockets with IP_PKTINFO or IPV6_RECVPKTINFO socket options enabled prior to recvmsg() calls that fail intermittently

Detection Strategies

Perform static analysis of Zephyr application source code for recvmsg() calls that allocate control buffers smaller than CMSG_SPACE(sizeof(struct in_pktinfo))
Audit firmware images and SDK versions to identify Zephyr builds in the v3.6.0 through v4.4.0 range
Instrument test environments with kernel address sanitizers to observe out-of-bounds writes originating from insert_pktinfo()

Monitoring Recommendations

Monitor Zephyr-based devices for unexplained reboots or kernel faults following network traffic bursts
Log all recvmsg() return values in application-layer telemetry to identify buffers that would have failed the corrected -ENOMEM check
Track upstream Zephyr security advisories and integrate them into device firmware update pipelines

How to Mitigate CVE-2026-10643

Immediate Actions Required

Upgrade Zephyr to a version containing commit 01fe77b2ec3885583f709a17c5203ce02bd77012 or later
Audit deployed firmware for use of IP_PKTINFO, IPV6_RECVPKTINFO, hoplimit, and timestamping ancillary options
Rebuild and reflash affected devices with a patched Zephyr build

Patch Information

The fix is available in the Zephyr Project repository. The corrected insert_pktinfo() uses NET_CMSG_SPACE(pktinfo_len) for the capacity check and returns -ENOMEM when the buffer is insufficient. See the Zephyr Project security commit for the authoritative patch.

Workarounds

Disable CONFIG_USERSPACE where feasible to eliminate the kernel heap corruption vector, understanding that supervisor-mode buffer corruption still occurs
Modify application code to allocate control buffers sized with CMSG_SPACE(sizeof(struct in_pktinfo)) before calling recvmsg()
Avoid enabling IP_PKTINFO, IPV6_RECVPKTINFO, hoplimit, and timestamping socket options on untrusted or shared UDP sockets until firmware is patched

bash

# Verify Zephyr version and rebuild with the patched tree
cd zephyr
git fetch origin
git log --oneline 01fe77b2ec3885583f709a17c5203ce02bd77012
west update
west build -b <board> <app> -p always