Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-15923— Infinite loop denial of service in Zephyr SDIO byte-I/O from a card-supplied zero max_blk_size

Quick assessment

Affected
zephyrproject zephyr
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Zephyr SDIO 子系统中， 文件里的函数 通过一个字节级别的 I/O 循环来完成传输，该循环每次迭代使用的步进值为 。其中 的值是直接由 从 SDIO 卡的 CIS 寄存器中的 FUNCE 元组解析而来，且未进行有效性校验。当某张卡报告的 为 0 时， 恒为 0， 永远不减少，导致循环无限自旋。 该循环可由多个公开的 SDIO 客户端 API 进入，包括 、 以及递增式寄存器读写辅助函数。这些函数在进入循环时都会持有每张卡的互斥锁 。因此，若某张卡宣告 ，则在首次发生非块对齐传输时，调用线程将被永久挂起，且

CVSS 4.6 · Medium

Affected Version Matrix 1

VendorProduct Version RangeStatus
zephyrproject zephyr 3.6.0< 4.4.2 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-15923

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Infinite loop denial of service in Zephyr SDIO byte-I/O from a card-supplied zero max_blk_size
Source: CVE Program / CVE List V5
Vulnerability Description
The Zephyr SDIO subsystem function sdio_io_rw_extended_helper() in subsys/sd/sdio.c finishes transfers with a byte-I/O loop that uses size = MIN(remaining, func->cis.max_blk_size) as the per-iteration step. The value func->cis.max_blk_size is decoded directly from the SDIO card's CIS FUNCE tuple in sdio_decode_cis() and is not validated. When a card reports a maximum block size of zero, size is always 0, remaining never decreases, and the loop spins forever. The loop is reached from the public SDIO client API used by drivers, including sdio_read_fifo(), sdio_write_fifo(), and the incrementing register read/write helpers, each of which enters the loop while holding the per-card mutex func->card->lock. A card advertising max_blk_size == 0 therefore hangs the calling thread permanently on its first non-block-aligned transfer and never releases the mutex, denying service to the SDIO peripheral (and any subsystem such as Wi-Fi that depends on it) until the device is reset. The malicious value must come from the SDIO card itself, so the defect is exploitable where a removable SDIO/combo card slot lets an attacker insert a crafted or malfunctioning card (a physical attack vector); on boards with a soldered SDIO peripheral it is not attacker-influenceable. There is no memory-safety, confidentiality, or integrity impact — only a permanent availability loss. The fix returns -EIO when func->cis.max_blk_size is zero, before the loop is entered.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
不可达退出条件的循环(无限循环)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
zephyrproject zephyr 3.6.0 ~ 4.4.2 -

II. Public POCs for CVE-2026-15923

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-15923

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-15923 (1)

Vendor Advisories for CVE-2026-15923 (1)

Same Patch Batch · zephyrproject · 2026-09-14 · 5 CVEs total

CVE-2026-16147 6.8 MEDIUM it82xx2 USB device controller submits incomplete OUT transfer buffers, causing use-after-f
CVE-2026-15893 6.5 MEDIUM Zephyr IPv6 Neighbor Discovery zero reachable time from crafted Router Advertisement cause
CVE-2026-15924 5.9 MEDIUM Use-after-free / double-free from unsynchronized concurrent access to the TLS client sessi
CVE-2026-16148 4.6 MEDIUM Kernel panic in the it82xx2 USB device controller driver via re-initialization of a busy d

IV. Related Vulnerabilities

Same product: zephyr
Same vendor: zephyrproject
Same weakness: CWE-835

V. Comments for CVE-2026-15923

No comments yet

Leave a comment