CVE-2026-10655: Zephyr SNTP Use-After-Free Vulnerability

CVE-2026-10655 Overview

CVE-2026-10655 is a use-after-free vulnerability [CWE-416] in the asynchronous Simple Network Time Protocol (SNTP) client of the Zephyr real-time operating system (RTOS). The flaw resides in subsys/net/lib/sntp/sntp.c, where sntp_close_async closes a User Datagram Protocol (UDP) socket file descriptor from the calling thread without synchronizing with the socket-service poll thread. A network peer or off-path attacker who drops or delays SNTP responses can trigger the timeout path repeatedly, driving a race between close and poll. The result is a networking-thread crash or potential memory corruption when the freed net_context slot is reallocated. Affected releases span Zephyr v4.2.0 through v4.4.0.

Critical Impact
Remote attackers can induce use-after-free of kernel poll structures by suppressing SNTP responses, leading to denial of service or memory corruption in Zephyr networking threads.

Affected Products

Zephyr RTOS v4.2.0
Zephyr RTOS v4.3.0
Zephyr RTOS v4.4.0

Discovery Timeline

2026-06-30 - CVE-2026-10655 published to the National Vulnerability Database (NVD)
2026-07-01 - Last updated in NVD database

Technical Details for CVE-2026-10655

Vulnerability Analysis

The asynchronous SNTP client in Zephyr closes a UDP socket immediately after detaching it from the network socket service. The socket service thread polls each socket via zvfs_poll, which registers a k_poll_event pointing into the socket's net_context (specifically &ctx->recv_q) and then blocks in k_poll without holding a reference or lock. net_context objects are drawn from the fixed pool contexts[CONFIG_NET_MAX_CONTEXTS] and reused after close.

When sntp_close_async executes on a different thread than the poll thread, the close frees and may reuse the net_context while the poll thread still has a poller node linked into the freed object. In the in-tree consumer subsys/net/lib/config/init_clock_sntp.c, the SNTP timeout handler runs on the system workqueue while the socket service thread remains blocked in poll on the same file descriptor.

Root Cause

The root cause is missing synchronization between the thread invoking sntp_close_async and the socket-service poll thread. The design allowed one thread to release kernel object memory while another thread retained live poller references to that memory, producing object confusion of kernel poll structures.

Attack Vector

The SNTP timeout path is the normal no-response failure mode. A network peer or off-path attacker who drops or delays SNTP/Network Time Protocol (NTP) responses can drive the racing close repeatedly. When NET_CONFIG_SNTP_INIT_RESYNC is enabled, the race can be triggered periodically without additional attacker action.

 void sntp_close_async(const struct net_socket_service_desc *service)
 {
-	struct sntp_ctx *ctx = service->pev->user_data;
-	/* Detach socket from socket service */
-	net_socket_service_unregister(service);
-	/* CLose the socket */
-	if (ctx) {
-		(void)zsock_close(ctx->sock.fd);
-	}
+	/* Detach socket from socket service with automatic close */
+	net_socket_service_close(service);
 }
 
 #endif /* CONFIG_NET_SOCKETS_SERVICE */

Source: Zephyr commit ef47bdf. The patch defers close to the socket service thread via net_socket_service_close using NET_SOCKET_SERVICE_CLOSE_SOCKETS, eliminating the cross-thread race.

Detection Methods for CVE-2026-10655

Indicators of Compromise

Unexpected crashes or faults in the Zephyr networking thread coinciding with SNTP timeout events.
Repeated SNTP request retransmissions without matching responses from the configured time server.
Kernel poll structure corruption reports or assertion failures referencing k_poll_event or net_context.

Detection Strategies

Monitor Zephyr device logs for SNTP timeout messages emitted by init_clock_sntp.c at abnormal frequencies.
Inspect network traffic for suppression, delay, or spoofing of UDP port 123 (SNTP/NTP) traffic targeting Zephyr devices.
Correlate device reboot telemetry with SNTP resync intervals defined by NET_CONFIG_SNTP_INIT_RESYNC.

Monitoring Recommendations

Collect crash dumps and fault reports from Zephyr devices for centralized analysis in a security data lake.
Alert on abnormal restart patterns of embedded devices running Zephyr v4.2.0 through v4.4.0.
Track NTP server reachability and response ratios from device fleets to detect adversary interference.

How to Mitigate CVE-2026-10655

Immediate Actions Required

Inventory all firmware images built on Zephyr v4.2.0, v4.3.0, or v4.4.0 that enable CONFIG_NET_SOCKETS_SERVICE and the SNTP client.
Apply the upstream fix from commit ef47bdf328b4206ac3b3922ec09184f7a6f7412a and rebuild affected firmware.
Restrict SNTP traffic to trusted time sources via network segmentation and firewall rules.

Patch Information

The fix in subsys/net/lib/sntp/sntp.c replaces the direct zsock_close call with net_socket_service_close, deferring socket closure to the same thread that performs the poll. See the Zephyr Security Advisory GHSA-34wr-cg29-c4mw and the remediation commit for details.

Workarounds

Disable the asynchronous SNTP client if time synchronization is not required for the deployment.
Disable NET_CONFIG_SNTP_INIT_RESYNC to prevent periodic re-triggering of the close path.
Pin devices to a trusted, low-latency SNTP server on an isolated network to reduce timeout-induced close races.

bash

# Configuration example: disable SNTP init in prj.conf until patched firmware is deployed
CONFIG_NET_CONFIG_CLOCK_SNTP_INIT=n
CONFIG_NET_CONFIG_SNTP_INIT_RESYNC=n