Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-15891— NULL pointer dereference in Zephyr MQTT-SN client when removing a non-responsive gateway

Quick assessment

Affected
zephyrproject zephyr
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

中的 MQTT-SN 客户端 keepalive 处理函数 在 PINGREQ 重试次数用尽后，会移除网关记录。该代码调用了 ，但丢弃了其返回值。该宏是一个纯表达式，并未对 进行赋值，因此无论链表内容如何， 始终保留其初始化值 NULL。 随后，代码对 NULL 指针 进行解引用（ ），并将其传递给 ，最终到达 。当启用 时，这将触发 ；在默认配置下，它会通过 NULL 指针进行写操作（ ），从而破坏 slab 空闲链表。其结果是导致系统崩溃/内核恐慌，或者在地址 0 可写的目标平台上造成静默的内存分配器损坏。 当

CVSS 7.5 · High

Possible ATT&CK Techniques 1 AI

T1495 · Firmware Corruption
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-15891

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
NULL pointer dereference in Zephyr MQTT-SN client when removing a non-responsive gateway
Source: CVE Program / CVE List V5
Vulnerability Description
The MQTT-SN client keepalive handler process_ping() in subsys/net/lib/mqtt_sn/mqtt_sn.c removes the gateway record after PINGREQ retries are exhausted. It invoked SYS_SLIST_PEEK_HEAD_CONTAINER(&client->gateways, gw, next) but discarded the result. That macro is a pure expression that does not assign to gw, so gw retained its NULL initializer regardless of the list contents. The code then dereferences the NULL gw (gw->gw_id) and passes it to mqtt_sn_gw_destroy(), reaching k_mem_slab_free(&gateways, NULL). With CONFIG_MEM_SLAB_POINTER_VALIDATE enabled this triggers k_panic(); in the default configuration it performs a write through the NULL pointer ((char )mem = slab->free_list;) and corrupts the slab free list. The outcome is a crash/kernel panic or, on targets where address 0 is writable, silent memory-allocator corruption. The vulnerable branch runs whenever the connected MQTT-SN gateway fails to answer keepalive PINGREQs for the configured number of retries. This condition is controlled by the remote peer: a malicious or compromised gateway, or an on-path/adjacent attacker that advertises itself as a gateway and then stops responding (or blackholes the real gateway's PINGRESPs), forces the client into the defect. MQTT-SN runs over UDP and no authentication is required. The impact is a remotely triggerable denial of service (availability) of the affected MQTT-SN client; there is no attacker-controlled data written. The sibling remover process_advertise() uses SYS_SLIST_FOR_EACH_CONTAINER_SAFE and is not affected. The fix assigns the macro's return value to gw.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
空指针解引用
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
zephyrproject zephyr 4.1.0 ~ 4.4.2 -

II. Public POCs for CVE-2026-15891

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-15891

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-15891 (1)

Vendor Advisories for CVE-2026-15891 (1)

IV. Related Vulnerabilities

Same product: zephyr
Same vendor: zephyrproject
Same weakness: CWE-476

V. Comments for CVE-2026-15891

No comments yet

Leave a comment