CVE-2026-15891 zephyrproject CVE debrief

Who should care

Defenders responsible for MQTT-SN client configuration and security should assess exposure and prioritize patching to prevent potential denial-of-service attacks. This involves reviewing the MQTT-SN client configuration and ensuring that the fix is applied to prevent exploitation. Additionally, defenders should monitor for potential exploitation attempts and review compensating controls for exposed systems while remediation is scheduled and verified.

Why it matters

A vulnerability in the MQTT-SN client keepalive handler process_ping() allows a remotely triggerable denial of service (availability) of the affected MQTT-SN client. Defenders should prioritize verifying and applying the patch to prevent potential denial-of-service attacks.

• Denial of service (availability) of the affected MQTT-SN client
• Potential crash/kernel panic or silent memory-allocator corruption

Technical summary

The MQTT-SN client keepalive handler process_ping() in subsys/net/lib/mqtt_sn/mqtt_sn.c removes the gateway record after PINGREQ retries are exhausted. However, it invokes SYS_SLIST_PEEK_HEAD_CONTAINER(&client->gateways, gw, next) but discards the result, leading to a NULL pointer dereference. The code then dereferences the NULL gw (gw->gw_id) and passes it to mqtt_sn_gw_destroy(), reaching k_mem_slab_free(&gateways, NULL). With CONFIG_MEM_SLAB_POINTER_VALIDATE enabled this triggers k_panic(); in the default configuration it performs a write through the NULL pointer ((char *)mem = slab->free_list;) and corrupts the slab free list.

Defensive priority

Defenders should prioritize verifying and applying the patch to prevent potential denial-of-service attacks. This involves reviewing the MQTT-SN client configuration and ensuring that the fix is applied to prevent exploitation.

Recommended defensive actions

• Verify and apply the patch to prevent potential denial-of-service attacks
• Review MQTT-SN client configuration to ensure the fix is applied
• Monitor for potential exploitation attempts
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The vulnerability is caused by the MQTT-SN client keepalive handler process_ping() removing the gateway record after PINGREQ retries are exhausted but not properly checking the result of SYS_SLIST_PEEK_HEAD_CONTAINER. This leads to a NULL pointer dereference and a crash/kernel panic or silent memory-allocator corruption.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.