CVE-2026-10643

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-10643
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-10643.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-10643
Aliases
  • GHSA-pvf7-7mrp-35w7
Published
2026-06-27T22:59:22Z
Modified
2026-10-28T10:46:00Z
Severity
  • 8.7 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:H CVSS Calculator
Summary
Out-of-bounds heap write in Zephyr `recvmsg()` ancillary-data path (`insert_pktinfo` undersizes the control-buffer capacity check)
Details

Zephyr's IP socket recvmsg() implementation (subsys/net/lib/sockets/sockets_inet.c, insert_pktinfo()) validated the user-supplied ancillary (msg_control) buffer using only the payload length (msg->msg_controllen < pktinfo_len) before writing a full control message consisting of an aligned cmsg header plus the payload. Because the check omitted the cmsg header size, a control buffer whose length falls in the under-checked window (e.g. 16-27 bytes for IPv4 IP_PKTINFO on a 64-bit target, where a single element actually occupies 28 bytes) passes the guard yet causes a fixed-size out-of-bounds write of up to one cmsg header (~12 bytes) past the end of the buffer.

Under CONFIG_USERSPACE the recvmsg verifier allocates a kernel-heap copy of the control buffer sized to msg_controllen and runs the implementation against it, so the overflow corrupts kernel heap memory and is triggerable from an unprivileged userspace thread; in supervisor mode it corrupts the caller's buffer.

The path is reachable on a UDP/IP socket with IP_PKTINFO/IPV6_RECVPKTINFO (or hoplimit/timestamping) enabled when the application calls recvmsg() with an undersized control buffer and a datagram is received; part of the overwritten bytes (the destination IP in ipi_addr) is influenced by the received packet.

The fix makes the capacity check use NET_CMSG_SPACE(pktinfo_len) (aligned header + aligned data) and returns -ENOMEM when the buffer is too small. Affected: v3.6.0 through v4.4.0.

Database specific 
{
    "cna_assigner":  "zephyr",
    "cwe_ids":  [
        "CWE-787"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/10xxx/CVE-2026-10643.json"
}
References

Affected packages

Git / github.com/zephyrproject-rtos/zephyr

Affected ranges

Type
GIT
Repo
https://github.com/zephyrproject-rtos/zephyr
Events
Introduced
8469084dfae85f854555f0607f2c838dad097235
Fixed
75f67d766726351b30199f9a2bf55803d717a3be
Introduced
684c9e8f32e4373a21098559f748f06915f950c9
Fixed
dccb09599635bdff17633fa7e9dab014b91dce90
Fixed
01fe77b2ec3885583f709a17c5203ce02bd77012
Database specific
Show details 
{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "4.0.0"
                },
                {
                    "fixed":  "4.3.1"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandardRange"
        },
        {
            "range":  [
                {
                    "introduced":  "4.4.0"
                },
                {
                    "fixed":  "4.4.2"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandardRange"
        },
        {
            "range":  [
                {
                    "fixed":  "01fe77b2ec3885583f709a17c5203ce02bd77012"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        }
    ]
}

Affected versions

v4.*
v4.0.0
v4.1.0
v4.1.0-rc1
v4.1.0-rc2
v4.1.0-rc3
v4.2.0
v4.2.0-rc1
v4.2.0-rc2
v4.2.0-rc3
v4.3.0
v4.3.0-rc1
v4.3.0-rc2
v4.3.0-rc3
v4.3.1-rc1
v4.4.0
v4.4.1
v4.4.1-rc1
v4.4.2-rc1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-10643.json"
vanir_signatures 
[
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "93070490098419855003463127825789133412",
            "length":  494
        },
        "id":  "CVE-2026-10643-8efa43a3",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/zephyrproject-rtos/zephyr/commit/01fe77b2ec3885583f709a17c5203ce02bd77012",
        "target":  {
            "file":  "subsys/net/lib/sockets/sockets_inet.c",
            "function":  "insert_pktinfo"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "102052527181878849922194957028947815418",
            "length":  265
        },
        "id":  "CVE-2026-10643-c7c78129",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/zephyrproject-rtos/zephyr/commit/01fe77b2ec3885583f709a17c5203ce02bd77012",
        "target":  {
            "file":  "subsys/net/lib/sockets/sockets_inet.c",
            "function":  "update_msg_controllen"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "38048884747434577753126370834059794080",
                "253329743279788993151357172659307805205",
                "26790773097149199038992527141419136845",
                "46640628259015598413850284768089117885",
                "25258093819572234639382930190642368735",
                "335088243181085051768238486100588623323",
                "180888898016146271010092349571265834240",
                "320605282933971403783815368048067037457",
                "148701799672699399510626572577472362171",
                "78273479388183368034361304253210751880"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-10643-dd732c3d",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/zephyrproject-rtos/zephyr/commit/01fe77b2ec3885583f709a17c5203ce02bd77012",
        "target":  {
            "file":  "subsys/net/lib/sockets/sockets_inet.c"
        }
    }
]
vanir_signatures_modified 
"2026-10-28T10:46:00Z"