MQTT-SN Client Vulnerability in Zephyr Project

CVE-2026-15891

What is CVE-2026-15891?

A flaw in the MQTT-SN client's keepalive handler can lead to a denial of service event. Specifically, during the PINGREQ retry process, the code fails to properly handle the gateway record, resulting in dereferencing a NULL pointer. This can cause a crash or kernel panic due to memory corruption, particularly in configurations where memory slab pointer validation is enabled. This vulnerability is exploitative when the connected MQTT-SN gateway does not respond to keepalive requests, which may occur due to a malicious gateway or an attacker impersonating a gateway. The result is an affected client's inability to maintain communication, leading to service availability issues.

References