CVE-2026-10643 zephyrproject CVE debrief

Who should care

Organizations using Zephyr's IP socket implementation, particularly those with unprivileged userspace threads or supervisor mode applications, should prioritize patching to prevent potential kernel heap corruption and unauthorized access.

Technical summary

The recvmsg() implementation in Zephyr's IP socket subsystem has a vulnerability that allows for a fixed-size out-of-bounds write of up to one cmsg header past the end of the buffer. This occurs when the user-supplied ancillary buffer is validated using only the payload length, omitting the cmsg header size. The issue is reachable on a UDP/IP socket with IP_PKTINFO/IPV6_RECVPKTINFO enabled when recvmsg() is called with an undersized control buffer and a datagram is received.

Defensive priority

Organizations using Zephyr's IP socket implementation should prioritize patching to prevent potential kernel heap corruption and unauthorized access.

Recommended defensive actions

• Apply the patch referenced in the mitigation or vendor reference
• Review and update affected Zephyr versions to 4.4.1 or later
• Monitor for potential exploitation attempts
• Verify and validate recvmsg() implementation in custom Zephyr applications
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE-2026-10643 vulnerability in Zephyr's IP socket recvmsg() implementation allows for a fixed-size out-of-bounds write of up to one cmsg header past the end of the buffer. This occurs when the user-supplied ancillary buffer is validated using only the payload length, omitting the cmsg header size. The issue is reachable on a UDP/IP socket with IP_PKTINFO/IPV6_RECVPKTINFO enabled when recvmsg() is called with an undersized control buffer and a datagram is received. The fix makes the capacity check use NET_CMSG_SPACE(pktinfo_len) and returns -ENOMEM when the buffer is too small.

Official resources