Zephyr RTOS SNTP Use-After-Free Race Condition Vulnerability Analysis

Vulnerability Overview In Zephyr's asynchronous SNTP client ( ), a use-after-free race condition occurs when closing a socket if the socket service is still polling. Specifically: The socket service thread polls each socket via and registers a pointing to the socket's within . When a object is allocated from and subsequently reused from a fixed pool, closing the socket results in the being freed. However, the polling thread may still hold references to the freed object, leading to a use-after-free of kernel data structures. Affected Versions Affected Versions: Zephyr v4.2.0 to v4.4.0 Fixed Versions: Zephyr 4.5.0 Remediation Remediation Method: The close operation is delayed to be executed by the socket service thread itself, implemented via ( ), ensuring the polling thread completes the close operation and eliminating the race condition. Fix Status: Merged into the branch, targeting version 4.5.0 (actual release version subject to confirmation). Introduction: Introduced by commit (net: lib: sntp: async query API, 2023-03-07). Evidence Relevant Code: - : delays closure via . - : Polling thread snapshot shows under lock closes without locks; now occurs on restart (lines 245-251). - : followed by blocking on objects without holding reference counts. - : sets , pointing to , which is freed on concurrent close. - : objects reside in a fixed, reusable array , potentially reallocated while polling registration is pending. - : runs on the system work queue and calls , competing with the socket service thread's polling. - : (old) vs. (new) demonstrates the delayed closure mechanism. - : Vulnerable code present in v4.2.0 through v4.4.0; fixed after 2026-05-03. Patch Branches: , , Pull Requests: - : (Merged) - : (Merged) - : (Merged) Additional Information Issue Links: Zephyr GitHub Issues Mailing List: Zephyr Vulnerabilities Due Date: 2026-06-30 CVSS v3 Base Metrics Attack Vector: Network Attack Complexity: High Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: None Integrity: Low Availability: High CVE ID CVE-2026-10655 Weakness CWE-416

Goal Reached Thanks to every supporter — we hit 100%!

Zephyr RTOS SNTP Use-After-Free Race Condition Vulnerability Analysis

More from this source