Denial of Service Vulnerability in Zephyr SDIO Subsystem by Zephyr Project

CVE-2026-15923

What is CVE-2026-15923?

The Zephyr SDIO subsystem contains a vulnerability in the sdio_io_rw_extended_helper() function that leads to an infinite loop when an SDIO card reports a maximum block size of zero. This defect occurs due to insufficient validation of the block size derived from the SDIO card's CIS FUNCE tuple, causing a permanent hang of the calling thread and effectively denying service to the SDIO peripheral. This vulnerability is particularly exploitable in devices with removable SDIO cards, allowing an attacker to insert a crafted card. The proper fix has been implemented to prevent the loop from engaging with a return value indicating an error when the maximum block size is reported as zero.

References