Zephyr's TLS Vulnerability in Socket Layer Affects Multiple Client Sessions

CVE-2026-15924

What is CVE-2026-15924?

The TLS socket layer in Zephyr RTOS has a vulnerability stemming from its handling of client session caching, which is managed through a global shared array. The lack of proper mutual exclusion can lead to race conditions between concurrent client sockets, resulting in a use-after-free error and potential double-free scenarios that corrupt the mbedTLS heap. Exploitation is possible when an application enables per-socket client session caching and initiates multiple concurrent TLS client connections. This can lead to significant memory corruption issues, manifesting as crashes or denial of service. The recent fix introduced a dedicated mutex to ensure serialized access to the client_cache, addressing the vulnerability effectively.

References