Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-15924— Use-after-free / double-free from unsynchronized concurrent access to the TLS client session cache in Zephyr sockets

Quick assessment

Affected
zephyrproject zephyr
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Zephyr 的 TLS socket 层（位于 ）维护了一个进程级的全局数组 ，用于缓存客户端会话，该数组被所有 TLS socket 上下文共享。负责修改和读取该数组的函数—— 、 、 以及配置恢复处理函数——会对每个条目的堆缓冲区（ ）进行分配、释放和解引用。在修复之前，对这些数据的访问仅通过每个 socket 上下文的互斥锁 （在 中为每个 socket 分配）进行序列化，但该锁无法在不同 socket 之间对共享缓存提供互斥保护。 由于 默认值为 1，任意两个并发的客户端 socket 会争用同一个缓存槽

CVSS 5.9 · Medium
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-15924

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Use-after-free / double-free from unsynchronized concurrent access to the TLS client session cache in Zephyr sockets
Source: CVE Program / CVE List V5
Vulnerability Description
Zephyr's TLS socket layer in subsys/net/lib/sockets/sockets_tls.c keeps a single process-global array, client_cache, of cached client sessions that is shared by every TLS socket context. The functions that mutate and read it — tls_session_save(), tls_session_get(), tls_session_cache_reset(), and the settings restore handler — allocate, free, and dereference each entry's heap buffer (entry->session). Before the fix these accesses were serialized only by the per-socket context mutex ctx->lock (assigned per socket in ctx_set_lock()), which provides no mutual exclusion between different sockets touching the shared cache. Because CONFIG_NET_SOCKETS_TLS_MAX_CLIENT_SESSION_COUNT defaults to 1, any two concurrent client sockets contend for the same slot. A thread in tls_session_get() reading entry->session inside mbedtls_ssl_session_load() can run concurrently with another thread in tls_session_save() that selects the same entry for reuse and executes mbedtls_free(entry->session) before reallocating — a use-after-free read, and a double-free when two saves evict the same entry. Both corrupt the mbedTLS heap. The cache is reached on ordinary client paths: at connect time via tls_session_store()/tls_session_restore(), and (on main) whenever a TLS 1.3 session ticket arrives during recv()/poll() via tls_session_store_current(). Exploitation requires an application that opts into per-socket client session caching (the TLS_SESSION_CACHE socket option, off by default) and runs concurrent TLS client connections on multiple threads; the timing that opens the window is influenced by the remote peer(s), so a malicious or compromised server can raise session-ticket frequency to widen it. The reliably-demonstrable impact is memory corruption leading to a crash or heap corruption (denial of service). The fix adds a dedicated session_cache_lock mutex taken across every accessor of client_cache, serializing all reads and frees and closing the race.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
释放后使用
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
zephyrproject zephyr 3.1.0 ~ 4.4.2 -

II. Public POCs for CVE-2026-15924

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-15924

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-15924 (1)

Vendor Advisories for CVE-2026-15924 (1)

Same Patch Batch · zephyrproject · 2026-09-14 · 5 CVEs total

CVE-2026-16147 6.8 MEDIUM it82xx2 USB device controller submits incomplete OUT transfer buffers, causing use-after-f
CVE-2026-15893 6.5 MEDIUM Zephyr IPv6 Neighbor Discovery zero reachable time from crafted Router Advertisement cause
CVE-2026-15923 4.6 MEDIUM Infinite loop denial of service in Zephyr SDIO byte-I/O from a card-supplied zero max_blk_
CVE-2026-16148 4.6 MEDIUM Kernel panic in the it82xx2 USB device controller driver via re-initialization of a busy d

IV. Related Vulnerabilities

Same product: zephyr
Same vendor: zephyrproject
Same weakness: CWE-416

V. Comments for CVE-2026-15924

No comments yet

Leave a comment