CVE-2026-18417

The Zephyr RTOS native BSD-socket layer contains a wild pointer dereference vulnerability when a TCP listening socket reports an asynchronous error. The root cause is type-punning an error status into the user_data field of struct net_context. In version v4.3.0 , a second interface-down event can...

CVE-2026-18417 Wild pointer dereference in Zephyr BSD sockets when a TCP listening socket reports an asynchronous error

The native BSD-socket layer recorded a pending asynchronous socket error by type-punning it into struct netcontext's void userdata field ctx-userdata = INTTOPOINTER-status in zsockacceptedcb, zsockreceivedcb, zsockconnectedcb and zsockclosectx in subsys/net/lib/sockets/socketsinet.c, reading it...

CVE-2026-18417 Wild pointer dereference in Zephyr BSD sockets when a TCP listening socket reports an asynchronous error

The native BSD-socket layer recorded a pending asynchronous socket error by type-punning it into struct netcontext's void userdata field ctx-userdata = INTTOPOINTER-status in zsockacceptedcb, zsockreceivedcb, zsockconnectedcb and zsockclosectx in subsys/net/lib/sockets/socketsinet.c, reading it...

CVE-2026-10646

Zephyr's BSD-sockets getaddrinfo implementation subsys/net/lib/sockets/getaddrinfo.c passes a pointer to a stack-allocated state object struct getaddrinfostate aistate as the userdata of an asynchronous DNS resolver query. The socket layer waits on a semaphore with a timeout deliberately set...