6 matches found
CVE-2026-19735
The RFC 6528 initial-sequence-number implementation in subsys/net/ip/tcp.c derived every TCP ISN from SHA-256uniquekey || four-tuple plus a uptime-derived offset, where uniquekey is a 128-bit secret filled once by syscsrandget. The return value of that call was discarded and the once guard was...
CVE-2026-19735 Predictable TCP initial sequence numbers when the RFC 6528 secret key generation fails silently in the Zephyr TCP stack
The RFC 6528 initial-sequence-number implementation in subsys/net/ip/tcp.c derived every TCP ISN from SHA-256uniquekey || four-tuple plus a uptime-derived offset, where uniquekey is a 128-bit secret filled once by syscsrandget. The return value of that call was discarded and the once guard was...
CVE-2026-19735 Predictable TCP initial sequence numbers when the RFC 6528 secret key generation fails silently in the Zephyr TCP stack
The RFC 6528 initial-sequence-number implementation in subsys/net/ip/tcp.c derived every TCP ISN from SHA-256uniquekey || four-tuple plus a uptime-derived offset, where uniquekey is a 128-bit secret filled once by syscsrandget. The return value of that call was discarded and the once guard was...
CVE-2026-19735
The Zephyr TCP stack contains a vulnerability where the RFC 6528 initial-sequence-number (ISN) implementation may use predictable values. If the sys_csrand_get() call fails during early boot (e.g., due to -ENODEV or -EIO from the entropy driver), the system fails to catch the error and leaves the...
CVE-2026-19735 Predictable TCP initial sequence numbers when the RFC 6528 secret key generation fails silently in the Zephyr TCP stack
The RFC 6528 initial-sequence-number implementation in subsys/net/ip/tcp.c derived every TCP ISN from SHA-256uniquekey || four-tuple plus a uptime-derived offset, where uniquekey is a 128-bit secret filled once by syscsrandget. The return value of that call was discarded and the once guard was...
CVE-2026-19735: Use of Insufficiently Random Values
The RFC 6528 initial-sequence-number implementation in subsys/net/ip/tcp.c derived every TCP ISN from SHA-256uniquekey || four-tuple plus a uptime-derived offset, where uniquekey is a 128-bit secret filled once by syscsrandget. The return value of that call was discarded and the once guard was...