CVE-2026-8718 Overview
CVE-2026-8718 is a heap buffer overflow [CWE-787] in the Zephyr Real-Time Operating System (RTOS) network stack. The flaw resides in tls_opt_dtls_peer_connection_id_value_get() within subsys/net/lib/sockets/sockets_tls.c. The function handles getsockopt(SOL_TLS, TLS_DTLS_PEER_CID_VALUE) and passes the caller-supplied optval directly to mbedtls_ssl_get_peer_cid() without confirming the buffer holds at least MBEDTLS_SSL_CID_OUT_LEN_MAX (32) bytes. A user-mode thread supplying a small optlen on a connected Datagram Transport Layer Security (DTLS) socket triggers a kernel-heap out-of-bounds write of up to 31 bytes. The vulnerability was introduced in Zephyr v3.5.0 when the TLS_DTLS_CID option was added.
Critical Impact
An unprivileged local thread can corrupt the Zephyr kernel heap, enabling integrity and availability compromise across a scope-changed boundary.
Affected Products
- Zephyr RTOS versions from v3.5.0 onward with CONFIG_MBEDTLS_SSL_DTLS_CONNECTION_ID enabled
- Zephyr builds using CONFIG_USERSPACE for the kernel-crossing exploitation path
- Applications using getsockopt(SOL_TLS, TLS_DTLS_PEER_CID_VALUE) on DTLS sockets with a negotiated peer Connection ID
Discovery Timeline
- 2026-08-10 - CVE-2026-8718 published to the National Vulnerability Database
- 2026-08-12 - Last updated in NVD database
Technical Details for CVE-2026-8718
Vulnerability Analysis
The defect sits at the boundary between the Zephyr socket layer and the underlying Mbed TLS library. When a user application calls getsockopt() with SOL_TLS and the TLS_DTLS_PEER_CID_VALUE option, Zephyr routes the request to tls_opt_dtls_peer_connection_id_value_get(). That handler forwards the raw optval pointer into mbedtls_ssl_get_peer_cid(), which copies the peer-negotiated DTLS Connection ID (CID) of 1 to 32 bytes into the buffer. The Mbed TLS function does not accept a destination-size parameter, so it relies entirely on its caller to size the buffer correctly.
Under CONFIG_USERSPACE, the syscall verifier z_vrfy_zsock_getsockopt bounce-buffers the user's optval into a kernel allocation sized to exactly optlen bytes via k_usermode_alloc_from_copy and z_thread_malloc. A short optlen therefore produces a short kernel heap buffer, and the subsequent CID copy writes past its end.
Root Cause
The root cause is missing buffer-size validation before invoking an API that lacks bounds enforcement. The pre-patch code trusted optlen without comparing it against MBEDTLS_SSL_CID_OUT_LEN_MAX. Combined with Mbed TLS's size-unaware copy semantics, this allowed an attacker-controllable delta of up to 31 bytes of overflow.
Attack Vector
An unprivileged user-mode thread on a Zephyr system opens or inherits a connected DTLS socket where the peer has negotiated a Connection ID. The thread calls getsockopt(SOL_TLS, TLS_DTLS_PEER_CID_VALUE, buf, &optlen) with optlen set below 32. The syscall path allocates a kernel-heap buffer of that smaller size, then Mbed TLS writes the full peer CID beyond that allocation. The overflow bytes are the remote peer's CID, giving a remote adversary influence over the corrupting content by controlling the CID during the DTLS handshake.
// Security patch in subsys/net/lib/sockets/sockets_tls.c
// net: sockets/tls: validate buffer in peer_connection_id_value_get
return -ENOTCONN;
}
+ if (*optlen < MBEDTLS_SSL_CID_OUT_LEN_MAX) {
+ return -EINVAL;
+ }
+
ret = mbedtls_ssl_get_peer_cid(&session_ctx->ssl, &enabled, optval, &optlen_local);
if (enabled) {
*optlen = optlen_local;
Source: Zephyr commit aa317825
Detection Methods for CVE-2026-8718
Indicators of Compromise
- Kernel-heap corruption panics or k_heap assertion failures on Zephyr devices with CONFIG_MBEDTLS_SSL_DTLS_CONNECTION_ID enabled
- Unexpected getsockopt calls with TLS_DTLS_PEER_CID_VALUE using optlen smaller than 32 bytes
- DTLS peers negotiating unusually long or attacker-shaped Connection ID values during handshakes
Detection Strategies
- Audit application source for calls to getsockopt(SOL_TLS, TLS_DTLS_PEER_CID_VALUE, ...) and verify each supplies a buffer of at least MBEDTLS_SSL_CID_OUT_LEN_MAX bytes
- Enable Zephyr kernel heap sentinel checks and memory protection features to surface out-of-bounds writes at runtime
- Review DTLS session logs for negotiated peer CID lengths approaching the 32-byte maximum
Monitoring Recommendations
- Instrument the syscall boundary to log optlen values passed to zsock_getsockopt for TLS/DTLS options
- Track firmware crash telemetry and correlate resets with active DTLS sessions using Connection ID
- Monitor build configurations across the device fleet to identify units compiled with both CONFIG_USERSPACE and CONFIG_MBEDTLS_SSL_DTLS_CONNECTION_ID
How to Mitigate CVE-2026-8718
Immediate Actions Required
- Apply the upstream Zephyr patch that rejects callers whose optlen is below MBEDTLS_SSL_CID_OUT_LEN_MAX with -EINVAL
- Rebuild and redeploy firmware for all devices running Zephyr v3.5.0 or later with DTLS Connection ID support
- Audit application code to ensure getsockopt callers pass a 32-byte buffer for TLS_DTLS_PEER_CID_VALUE
Patch Information
The fix is delivered in Zephyr commit aa317825a55a401315e8e17f620c70c02e8f176d, which adds a size check before the Mbed TLS call. Details are published in GitHub Security Advisory GHSA-p3r6-mx6c-33gq and the corresponding upstream commit.
Workarounds
- Disable CONFIG_MBEDTLS_SSL_DTLS_CONNECTION_ID in the Zephyr build configuration if DTLS Connection ID is not required
- Disable CONFIG_USERSPACE on devices where kernel/user separation is not needed, eliminating the syscall bounce-buffer path
- Wrap application getsockopt calls in a helper that enforces a 32-byte minimum buffer size before invoking the syscall
# Kconfig adjustment to remove the vulnerable code path
# prj.conf
CONFIG_MBEDTLS_SSL_DTLS_CONNECTION_ID=n
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
