TCP Connection Management Vulnerability in Zephyr RTOS by the Zephyr Project

CVE-2026-5590

What is CVE-2026-5590?

A race condition arises during the teardown of TCP connections in Zephyr RTOS, which can result in the tcp_recv() function operating on a connection that has already been released. This situation occurs when tcp_conn_search() returns NULL while processing a SYN packet, leading to the dereferencing of a NULL pointer obtained from stale context data in tcp_backlog_is_full(). This flaw may ultimately cause the system to crash, underscoring the importance of prompt mitigation and updates.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References