CVE-2026-15924

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-15924
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-15924.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-15924
Aliases
  • GHSA-wcgm-pq6x-v2gf
Published
2026-09-14T19:33:45Z
Modified
2026-09-16T08:29:35Z
Severity
  • 5.9 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
Use-after-free / double-free from unsynchronized concurrent access to the TLS client session cache in Zephyr sockets
Details

Zephyr's TLS socket layer in subsys/net/lib/sockets/sockets_tls.c keeps a single process-global array, client_cache, of cached client sessions that is shared by every TLS socket context. The functions that mutate and read it — tls_session_save(), tls_session_get(), tls_session_cache_reset(), and the settings restore handler — allocate, free, and dereference each entry's heap buffer (entry->session). Before the fix these accesses were serialized only by the per-socket context mutex ctx->lock (assigned per socket in ctx_set_lock()), which provides no mutual exclusion between different sockets touching the shared cache.

Because CONFIG_NET_SOCKETS_TLS_MAX_CLIENT_SESSION_COUNT defaults to 1, any two concurrent client sockets contend for the same slot. A thread in tls_session_get() reading entry->session inside mbedtls_ssl_session_load() can run concurrently with another thread in tls_session_save() that selects the same entry for reuse and executes mbedtls_free(entry->session) before reallocating — a use-after-free read, and a double-free when two saves evict the same entry. Both corrupt the mbedTLS heap. The cache is reached on ordinary client paths: at connect time via tls_session_store()/tls_session_restore(), and (on main) whenever a TLS 1.3 session ticket arrives during recv()/poll() via tls_session_store_current().

Exploitation requires an application that opts into per-socket client session caching (the TLS_SESSION_CACHE socket option, off by default) and runs concurrent TLS client connections on multiple threads; the timing that opens the window is influenced by the remote peer(s), so a malicious or compromised server can raise session-ticket frequency to widen it. The reliably-demonstrable impact is memory corruption leading to a crash or heap corruption (denial of service). The fix adds a dedicated session_cache_lock mutex taken across every accessor of client_cache, serializing all reads and frees and closing the race.

Database specific 
{
    "cna_assigner": "zephyr",
    "cwe_ids": [
        "CWE-416"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/15xxx/CVE-2026-15924.json"
}
References

Affected packages

Git / github.com/zephyrproject-rtos/zephyr

Affected ranges

Type
GIT
Repo
https://github.com/zephyrproject-rtos/zephyr
Events
Introduced
2ddd73feafd3316af2c547c34d6969bea637d5c6
Fixed
7f9d8ee32ba9a93fc1dbb192ca2a591ac0853bdc
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "3.1.0"
        },
        {
            "fixed": "4.4.2"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

v3.*
v3.1.0
v3.2.0
v3.2.0-rc1
v3.2.0-rc2
v3.2.0-rc3
v3.3.0
v3.3.0-rc1
v3.3.0-rc2
v3.3.0-rc3
v3.4.0
v3.4.0-rc1
v3.4.0-rc2
v3.4.0-rc3
v3.5.0
v3.5.0-rc1
v3.5.0-rc2
v3.5.0-rc3
v3.6.0
v3.6.0-rc1
v3.6.0-rc2
v3.6.0-rc3
v3.7.0
v3.7.0-rc1
v3.7.0-rc2
v3.7.0-rc3
v4.*
v4.0.0
v4.0.0-rc1
v4.0.0-rc2
v4.0.0-rc3
v4.1.0
v4.1.0-rc1
v4.1.0-rc2
v4.1.0-rc3
v4.2.0
v4.2.0-rc1
v4.2.0-rc2
v4.2.0-rc3
v4.3.0
v4.3.0-rc1
v4.3.0-rc2
v4.3.0-rc3
v4.4.0
v4.4.0-rc1
v4.4.0-rc2
v4.4.0-rc3
zephyr-v3.*
zephyr-v3.1.0
zephyr-v3.2.0
zephyr-v3.3.0
zephyr-v3.4.0
zephyr-v3.5.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-15924.json"
vanir_signatures 
[
    {
        "deprecated": false,
        "digest": {
            "function_hash": "84076503673132904141263879048588968409",
            "length": 268
        },
        "id": "CVE-2026-15924-4b86447a",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/zephyrproject-rtos/zephyr/commit/7f9d8ee32ba9a93fc1dbb192ca2a591ac0853bdc",
        "target": {
            "file": "subsys/net/lib/sockets/sockets_tls.c",
            "function": "tls_session_cache_reset"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "201406064147848106915555039872883681264",
            "length": 1210
        },
        "id": "CVE-2026-15924-53402769",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/zephyrproject-rtos/zephyr/commit/7f9d8ee32ba9a93fc1dbb192ca2a591ac0853bdc",
        "target": {
            "file": "subsys/net/lib/sockets/sockets_tls.c",
            "function": "tls_session_cache_settings_set"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "145714100487138061576657184657309090498",
                "62580723398833153143452562272082478912",
                "332939560407895060105890456812682010130",
                "199602280941156675710256089388890393346",
                "114459422250821868164400832398122960497",
                "31340520617935540883440767263036900167",
                "43063730323709261002551305858281728497",
                "301383632932240578853305007505149360620",
                "91163646166306232384269796500807707382",
                "302730253905558391526285520947570010370",
                "90388764129299465477079520699021125707",
                "176118217375137089943066269527225077359",
                "280927832207701714584639055571533665687",
                "71375762766798064896835323100319553567",
                "213785451428253995381116024211750543794",
                "196071985676753059500165616649561959242",
                "35137369956682148237614125693909989672",
                "153653758822270457578660630621626543039",
                "179624416511084041984267343800720065994",
                "81866648921522440542120969231706707123",
                "43930327957758679415874712418383816599",
                "313528386589611146665554900553938805306",
                "49712149386114833018735637741882858042",
                "151283791327528816898907513477041299587",
                "249144780485986174051521908971830759959",
                "296952165173771992712585670235462823456",
                "170239761794953073178753756827989744776",
                "320274288923332347708315305366139604473",
                "425256266874141211362313466229675157",
                "67947222632328565541991166796053424189",
                "53077791541773218933844118521789765651",
                "119801705250830911890683466671057997874",
                "1584446233370852472196192268172063058",
                "272770982209385561943549677340675114199",
                "200970506084229117032904947150905156960",
                "36470715159955325718841117268227002616",
                "26931372703168500815694986267020133058",
                "175309926310652562995302257484236816114",
                "316325400781193306417515239160897289861",
                "130792064144651751152617933231792648861",
                "256931234936778836312623579985271061056",
                "254885714533638183453037424065321589632",
                "20876143595759419181033644362876483773",
                "145792379319390159584657223830236298907",
                "326638803312684595041629695835201062935",
                "316295405501817236814878198707255112693",
                "61759151501417486904366718914854903313",
                "152816393006465133603965952394418525545",
                "32251927845796242613049555711052830719",
                "300085509605217701269836585501839299683",
                "274017481954861006601230022213625430564",
                "15966590562585794418137467187256164305",
                "242299890830378680909689838888206037876",
                "129825842519581594170568226340920616116",
                "252191006116875071775745768303029238360",
                "49390295369484556483758249185696295024",
                "300224996220380546076727173830483064216",
                "147012772364709519519777052940122606703",
                "85167844315930382736606091076340230471",
                "284895670379811693735864102721713928256",
                "8442631838651106952104255735457054522",
                "76344666524373614246412722530788769435",
                "261537018777599863378332214265798641150",
                "257069540004015075617086053311605769066",
                "175092987475208270529396137139230940660",
                "150923495869570028367908773332357919100",
                "254537464804417944353567358071367363153",
                "150542741938066830386324376355364699818",
                "17038508577048407006413434684871742260",
                "104646527592843862511000755154891766067",
                "215438852887920263842119435499529738719"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-15924-6c9e8bed",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/zephyrproject-rtos/zephyr/commit/7f9d8ee32ba9a93fc1dbb192ca2a591ac0853bdc",
        "target": {
            "file": "subsys/net/lib/sockets/sockets_tls.c"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "97860790787190789619820524674758005848",
            "length": 1274
        },
        "id": "CVE-2026-15924-b0dad983",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/zephyrproject-rtos/zephyr/commit/7f9d8ee32ba9a93fc1dbb192ca2a591ac0853bdc",
        "target": {
            "file": "subsys/net/lib/sockets/sockets_tls.c",
            "function": "tls_session_save"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "159073813060476223658901981520963074318",
            "length": 574
        },
        "id": "CVE-2026-15924-d21585c8",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/zephyrproject-rtos/zephyr/commit/7f9d8ee32ba9a93fc1dbb192ca2a591ac0853bdc",
        "target": {
            "file": "subsys/net/lib/sockets/sockets_tls.c",
            "function": "tls_session_get"
        }
    }
]
vanir_signatures_modified 
"2026-09-16T08:29:35Z"