CVE-2026-19735

The Zephyr TCP stack contains a vulnerability where the RFC 6528 initial-sequence-number (ISN) implementation may use predictable values. If the sys_csrand_get() call fails during early boot (e.g., due to -ENODEV or -EIO from the entropy driver), the system fails to catch the error and leaves the...