CVE-2026-10634 zephyrproject CVE debrief

Who should care

Defenders responsible for Zephyr-based systems, particularly those using the native TCP stack, should assess exposure and prioritize patching or applying workarounds. This includes operators managing affected platforms, vulnerability management teams, and security teams responsible for monitoring and incident response.

Why it matters

A use-after-free vulnerability in Zephyr's native TCP stack can cause a denial of service and potentially information disclosure. Defenders responsible for Zephyr-based systems, particularly those using the native TCP stack, should assess exposure and prioritize patching or applying workarounds.

• Denial of service due to system crash
• Potential information disclosure due to attacker-influenced object access

Technical summary

The vulnerability is caused by a use-after-free in the net_tcp_foreach() function. The function iterates the global connection list and invokes a per-connection callback. However, during the callback, a concurrent tcp_conn_release() can remove and free the cached next connection, leading to a use-after-free. This defect was introduced with the modern (TCP2) stack in 2020 and affects releases up to and including v4.4.0. The fix moves the connection/context teardown in tcp_conn_release() inside the tcp_lock critical section and keeps tcp_lock held across the callback in net_tcp_foreach().

Defensive priority

Defenders should prioritize verifying affected versions, assessing exposure, and applying patches or workarounds.

Recommended defensive actions

• Verify affected versions and assess exposure
• Apply patches or workarounds
• Monitor for concurrent tcp_conn_release() and net_tcp_foreach() usage
• Review compensating controls for exposed systems
• Check relevant monitoring, detection, and logs for exposed assets
• Track exceptions and retest remediated assets
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance

Evidence notes

The vulnerability is caused by a use-after-free in the net_tcp_foreach() function. The function iterates the global connection list and invokes a per-connection callback. However, during the callback, a concurrent tcp_conn_release() can remove and free the cached next connection, leading to a use-after-free.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.