Use-after-free vulnerability in Zephyr TCP stack affects multiple versions

CVE-2026-10634

What is CVE-2026-10634?

The vulnerability in Zephyr's native TCP stack occurs when the net_tcp_foreach() function iterates through the global connection list. During the callback invocation, the tcp_lock is released, allowing concurrent operations that can manipulate list nodes. This creates a scenario where dereferencing a freed memory block may lead to system crashes and potentially expose sensitive information if the memory has been reallocated. The vulnerability affects versions of the TCP stack released up to and including v4.4.0 and has been addressed by ensuring that connection teardown occurs within a critical section.

References