Asynchronous SNTP Client Vulnerability in Zephyr OS by Zephyr Project

CVE-2026-10655

What is CVE-2026-10655?

The vulnerability in the asynchronous SNTP client of Zephyr OS arises from improper synchronization between threads, leading to potential denial of service and memory corruption. When the SNTP timeout handler is invoked from one thread while another thread is polling on the same socket, a race condition can occur that allows for premature closure of socket resources. This situation can result in the reuse of memory associated with freed socket contexts, ultimately causing crashes in the networking thread and creating opportunities for attackers to manipulate SNTP responses. A fix has been implemented to close sockets within the same thread that manages the polling, enhancing the security and stability of the system.

References