CVE-2026-18417: Zephyr RTOS Network Stack DOS Vulnerability

CVE-2026-18417 Overview

CVE-2026-18417 is a type confusion vulnerability [CWE-843] in the Zephyr real-time operating system (RTOS) BSD socket layer. The defect resides in subsys/net/lib/sockets/sockets_inet.c, where the socket layer type-punned a pending asynchronous errno value into the struct net_contextuser_data void pointer field. When a network interface hosting a listening TCP socket goes down repeatedly, the network stack dereferences the poisoned pointer as a parent context, triggering a kernel fatal error. The issue affects Zephyr v4.3.0 in its most reachable form and remains partially exploitable on v4.3.1 and v4.4.x through a narrower race and via getsockopt(SO_ERROR).

Critical Impact
An adjacent attacker who can force repeated link-down events on a Zephyr device with an open listening TCP socket can trigger a wild-pointer dereference in the kernel, causing device crash or reset.

Affected Products

Zephyr RTOS v4.3.0 (primary crash path)
Zephyr RTOS v4.3.1 (narrower race and getsockopt(SO_ERROR) path)
Zephyr RTOS v4.4.x releases prior to the fix

Discovery Timeline

2026-09-29 - CVE-2026-18417 published to the National Vulnerability Database
2026-09-30 - Last updated in NVD database

Technical Details for CVE-2026-18417

Vulnerability Analysis

The native BSD socket layer stored a pending asynchronous socket error by writing ctx->user_data = INT_TO_POINTER(-status) inside zsock_accepted_cb(), zsock_received_cb(), zsock_connected_cb(), and zsock_close_ctx(). The same user_data field is owned by the network stack for listening TCP contexts. net_tcp_accept() stores the parent context pointer there, and the TCP core passes it back to the registered accept callback. A failed accept therefore left a small integer (an errno value) where the stack expected a struct net_context pointer.

When the interface carrying a listening TCP socket goes down, close_tcp_conn() in subsys/net/ip/tcp.c invokes the accept callback with -ENETDOWN and the context's user_data. In v4.3.0 the callback was not disarmed afterward, so a second interface-down event forwarded the previously stored errno back into zsock_accepted_cb(). The callback then dereferenced the integer as a parent context and executed stores through it, including sock_set_error()'s read-modify-write of socket_data and k_fifo_cancel_wait(&parent->recv_q).

Root Cause

The root cause is a type confusion [CWE-843] between two distinct semantics assigned to the single user_data void pointer. Both a legitimate parent context pointer and an encoded errno integer share the same storage. The fix introduces a dedicated net_context.sock_error field and converts all producers and consumers to sock_set_error() and sock_get_error(), leaving user_data untouched.

Attack Vector

The triggering condition is a network interface state change rather than attacker-supplied packet content. A practical attacker is one able to force the link down repeatedly, such as an adjacent attacker disrupting a wireless link, or one with local or physical access. Because the faulting address and stored data are fixed small constants derived from the errno value, the outcome is a wild-pointer access leading to a kernel fatal error, producing a denial of service rather than attacker-directed memory corruption.

// Security patch in subsys/net/lib/sockets/sockets_inet.c
// net: sockets: Store async socket error in net_context
		(void)net_context_recv(ctx, NULL, K_NO_WAIT, NULL);
	}

-	ctx->user_data = INT_TO_POINTER(EINTR);
-	sock_set_error(ctx);
+	sock_set_error(ctx, EINTR);

	zsock_flush_queue(ctx);

Source: Zephyr commit ef370a57

// Security patch in include/zephyr/net/net_context.h
	/** BSD socket private data */
	void *socket_data;

+	/** Pending socket error (positive errno) reported asynchronously by
+	 *  the network stack. Valid only while the SOCK_ERROR flag is set;
+	 *  consumed via SO_ERROR or by the next blocking socket call.
+	 */
+	int sock_error;
+
	/** Per-socket packet or connection queues */
	union {
		struct k_fifo recv_q;

Source: Zephyr commit ef370a57

Detection Methods for CVE-2026-18417

Indicators of Compromise

Unexpected kernel fatal error logs referencing zsock_accepted_cb(), sock_set_error(), or k_fifo_cancel_wait on a Zephyr device.
Repeated device resets or watchdog reboots correlated with wireless link disruption or interface flapping.
getsockopt(SO_ERROR) returning implausibly large integer values on affected releases, indicating a kernel pointer leak to userspace.

Detection Strategies

Inventory embedded devices running Zephyr RTOS and identify builds based on v4.3.0, v4.3.1, or v4.4.x prior to the fix commit ef370a57.
Instrument applications that call zsock_listen() to log link-state transitions and correlate crashes with NET_EVENT_IF_DOWN events.
Review firmware crash dumps for faulting addresses that resemble small positive integers, which characterize the wild-pointer dereference pattern.

Monitoring Recommendations

Monitor telemetry for repeated interface-down events on IoT and edge devices exposing listening TCP sockets.
Track device uptime and reboot counters to identify populations susceptible to link-flap-induced crashes.
Alert on adjacent-network conditions such as deauthentication floods or repeated Wi-Fi beacon losses that could be weaponized to trigger the defect.

How to Mitigate CVE-2026-18417

Immediate Actions Required

Upgrade Zephyr-based firmware to a release containing commit ef370a57d07637aaee8cec7b0bcebf4002ac8f54 or the backport 269cb8823d3 on the v4.3 branch.
Rebuild and redeploy firmware for any product that keeps a listening TCP socket open across link transitions.
Restrict physical and radio-frequency access to affected devices until patched firmware is deployed.

Patch Information

The upstream fix is tracked in GitHub Security Advisory GHSA-p8r8-8mw8-3wf9 and applied in Zephyr commit ef370a57. The patch adds a dedicated sock_error field to struct net_context and updates every call site to use sock_set_error() and sock_get_error(). As a side effect, getsockopt(SO_ERROR) no longer returns the kernel address previously stored in user_data.

Workarounds

Close listening TCP sockets before interface-down events by handling NET_EVENT_IF_DOWN in application code and re-creating the socket after link restoration.
Avoid calling getsockopt(SO_ERROR) on affected releases where kernel pointer disclosure through user_data is possible.
Where feasible, disable the affected network interface at runtime when the device is not actively serving connections.

bash

# Verify the presence of the fix in a Zephyr source tree
cd zephyr
git log --oneline ef370a57d07637aaee8cec7b0bcebf4002ac8f54 -1
grep -n "int sock_error" include/zephyr/net/net_context.h
grep -n "sock_set_error(ctx, EINTR)" subsys/net/lib/sockets/sockets_inet.c