CVE-2026-10634

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-10634
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-10634.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-10634
Aliases
  • GHSA-6c57-xfhw-j26x
Published
2026-06-15T14:16:43Z
Modified
2026-10-27T07:19:49Z
Severity
  • 4.8 (Medium) CVSS_V3 - CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
Use-after-free in Zephyr native TCP `net_tcp_foreach()` due to dropping `tcp_lock` during the callback
Details

Zephyr's native TCP stack iterates the global connection list in net_tcp_foreach() (subsys/net/ip/tcp.c) using the SYS_SLIST_FOR_EACH_CONTAINER_SAFE macro, which caches a pointer to the next list node. Prior to this fix the function released tcp_lock while invoking the per-connection callback and re-acquired it afterwards.

During that window a concurrent tcp_conn_release(), running on the dedicated TCP work-queue thread when a connection's reference count drops to zero (e.g. a remote peer closing or resetting the connection), can remove and k_mem_slab_free() the cached next connection. When the iterator advances it dereferences the freed (and possibly reallocated) slab memory — a use-after-free that can crash the system (denial of service) and, if the slot has been reused, cause the callback to operate on an attacker-influenced object (potential information disclosure or further fault).

net_tcp_foreach() is reached in production via the net conn network shell command and via net_tcp_close_all_for_iface() on interface-down; the freeing side is driven by ordinary TCP traffic.

The fix moves the connection/context teardown in tcp_conn_release() inside the tcp_lock critical section and keeps tcp_lock held across the callback in net_tcp_foreach(). The defect was introduced with the modern (TCP2) stack in 2020 and affects releases up to and including v4.4.0.

Database specific 
{
    "cna_assigner":  "zephyr",
    "cwe_ids":  [
        "CWE-416"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/10xxx/CVE-2026-10634.json"
}
References

Affected packages

Git / github.com/zephyrproject-rtos/zephyr

Affected ranges

Type
GIT
Repo
https://github.com/zephyrproject-rtos/zephyr
Events
Introduced
468eb56cf242eedba62006ee758700ee6148763f
Fixed
75f67d766726351b30199f9a2bf55803d717a3be
Introduced
684c9e8f32e4373a21098559f748f06915f950c9
Fixed
1f6485eca25431b5ff27ce9a754218c9e559bbbb
Fixed
cd85e0e890ab89815c4cbc0a8fbc03a3efa84dc2
Database specific
Show details 
{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "3.6.0"
                },
                {
                    "fixed":  "4.3.1"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandardRange"
        },
        {
            "range":  [
                {
                    "introduced":  "4.4.0"
                },
                {
                    "fixed":  "4.4.1"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandardRange"
        },
        {
            "range":  [
                {
                    "fixed":  "cd85e0e890ab89815c4cbc0a8fbc03a3efa84dc2"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        }
    ]
}

Affected versions

v3.*
v3.6.0
v3.7.0
v3.7.0-rc1
v3.7.0-rc2
v3.7.0-rc3
v4.*
v4.0.0
v4.0.0-rc1
v4.0.0-rc2
v4.0.0-rc3
v4.1.0
v4.1.0-rc1
v4.1.0-rc2
v4.1.0-rc3
v4.2.0
v4.2.0-rc1
v4.2.0-rc2
v4.2.0-rc3
v4.3.0
v4.3.0-rc1
v4.3.0-rc2
v4.3.0-rc3
v4.3.1-rc1
v4.4.0
v4.4.1-rc1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-10634.json"
vanir_signatures 
[
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "19597484376005590927502039717861768313",
            "length":  1994
        },
        "id":  "CVE-2026-10634-47b95d27",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/zephyrproject-rtos/zephyr/commit/cd85e0e890ab89815c4cbc0a8fbc03a3efa84dc2",
        "target":  {
            "file":  "subsys/net/ip/tcp.c",
            "function":  "tcp_conn_release"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "332853186440509625598210866463747658133",
                "323594997656651687244022834811981584745",
                "54436491728176470801485688628561627151",
                "106134269177292816782091578309939490182",
                "81741407752632640810436830462734305782",
                "33470003866093177968610789397059906199",
                "135652235611154300000958119033127445830",
                "202306526288956983077902390169892874091",
                "149967299792212201862500449141759902210",
                "301325107151072587846342196187784141245",
                "155423496716345482171499468375119650922",
                "29936292204666648320252042663748301102",
                "317941538366019176996778066117580854500",
                "247625727048864440014382428845538395958"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-10634-d3871ae0",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/zephyrproject-rtos/zephyr/commit/cd85e0e890ab89815c4cbc0a8fbc03a3efa84dc2",
        "target":  {
            "file":  "subsys/net/ip/tcp.c"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "128160231651944326781890441275149168807",
            "length":  356
        },
        "id":  "CVE-2026-10634-f2b9fc49",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/zephyrproject-rtos/zephyr/commit/cd85e0e890ab89815c4cbc0a8fbc03a3efa84dc2",
        "target":  {
            "file":  "subsys/net/ip/tcp.c",
            "function":  "net_tcp_foreach"
        }
    }
]
vanir_signatures_modified 
"2026-10-27T07:19:49Z"