Network-influenced Use-After-Return Vulnerability in Zephyr BSD Sockets

CVE-2026-10646

What is CVE-2026-10646?

The vulnerability in Zephyr's implementation of getaddrinfo() relates to improper handling of asynchronous DNS resolver queries. By passing a pointer to a stack-allocated object without proper cancellation of previous queries, there is potential for network packets to invoke callbacks with expired stack references. This leads to potential memory corruption or denial of service due to an attacker being able to replay or spoof the DNS responses, resulting in stack memory being incorrectly manipulated.

References