CVE-2026-79981 zephyrproject CVE debrief

Who should care

Defenders responsible for DNS configuration and security should assess exposure and prioritize patching or mitigation. This vulnerability requires verification from official sources to determine affected versions and remediation steps.

Why it matters

A vulnerability in the DNS stub resolver allows an off-path attacker to forge DNS answers, potentially leading to resolver cache poisoning. Defenders responsible for DNS configuration and security should assess exposure and prioritize patching or mitigation.

• An off-path attacker can forge DNS answers, potentially leading to resolver cache poisoning
• The attack requires UDP reachability to the device and guessing a 16-bit transaction identifier
• The issue is addressed by randomizing the source port for DNS queries

Technical summary

The DNS stub resolver in subsys/net/lib/dns/resolve.c binds one UDP socket per configured server when the resolver context is initialised. The local port is left at 0, allowing the stack to pick an ephemeral port exactly once. This results in a constant source port for the lifetime of the resolver context, while only the 16-bit transaction identifier varies per query. An off-path attacker can exploit this by guessing the identifier and flooding answers for a predictable query name across the 16-bit identifier space during a query window, potentially leading to resolver cache poisoning.

Defensive priority

Medium

Recommended defensive actions

• Review and apply the patch provided by the vendor
• Verify the configuration of the DNS stub resolver
• Monitor DNS query traffic for suspicious activity
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE description provides technical details about the vulnerability, including the affected component, attack vector, and proposed fix. The NVD entry is currently awaiting analysis. To verify, defenders should review the official advisory and assess exposure based on the affected product deployments. The attack requires UDP reachability to the device and guessing a 16-bit transaction identifier. Evidence of exploitation includes monitoring DNS query traffic for suspicious activity and verifying the configuration of the DNS stub

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.