What is the CVSS score of CVE-2026-10634?

CVE-2026-10634 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-10634?

Yes, a patch is available for CVE-2026-10634. Update the affected software to the latest version immediately.

Zephyr RTOS CVE-2026-10634

EUVD-2026-36727 MEDIUM

Use After Free (CWE-416)

2026-06-15 zephyr

Use After Free Memory Corruption Information Disclosure Denial Of Service Zephyr

5.3

CVSS 3.1 · NVD

Severity by source

Vendor (zephyr) PRIMARY

MEDIUM

qualitative

NVD

5.3 MEDIUM

AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

5.4 MEDIUM

Adjacent vector and high complexity confirmed by race condition; PR:L for shell requirement; C:L rather than C:N because description explicitly identifies information disclosure via slab reuse as a realistic outcome.

3.1 AV:A/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:H

4.0 AV:A/AC:H/AT:P/PR:L/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (zephyr).

CVSS VectorNVD

CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Adjacent

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

CVSS changed

Jul 01, 2026 - 14:07 NVD

4.8 (MEDIUM) 5.3 (MEDIUM)

Source Code Evidence Fetched

Jun 15, 2026 - 16:31 vuln.today

Analysis Generated

Jun 15, 2026 - 16:31 vuln.today

DescriptionNVD

Zephyr's native TCP stack iterates the global connection list in net_tcp_foreach() (subsys/net/ip/tcp.c) using the SYS_SLIST_FOR_EACH_CONTAINER_SAFE macro, which caches a pointer to the next list node. Prior to this fix the function released tcp_lock while invoking the per-connection callback and re-acquired it afterwards. During that window a concurrent tcp_conn_release(), running on the dedicated TCP work-queue thread when a connection's reference count drops to zero (e.g. a remote peer closing or resetting the connection), can remove and k_mem_slab_free() the cached next connection. When the iterator advances it dereferences the freed (and possibly reallocated) slab memory - a use-after-free that can crash the system (denial of service) and, if the slot has been reused, cause the callback to operate on an attacker-influenced object (potential information disclosure or further fault). net_tcp_foreach() is reached in production via the 'net conn' network shell command and via net_tcp_close_all_for_iface() on interface-down; the freeing side is driven by ordinary TCP traffic. The fix moves the connection/context teardown in tcp_conn_release() inside the tcp_lock critical section and keeps tcp_lock held across the callback in net_tcp_foreach(). The defect was introduced with the modern (TCP2) stack in 2020 and affects releases up to and including v4.4.0.

AnalysisAI

Use-after-free in Zephyr RTOS's native TCP2 stack allows a concurrent connection teardown - triggered by ordinary TCP traffic from an adjacent-network peer - to invalidate a cached iterator pointer in net_tcp_foreach(), crashing the system or causing the iterator callback to operate on attacker-influenced reallocated memory. All Zephyr releases from the TCP2 stack introduction in 2020 through v4.4.0 (inclusive) are affected. No public exploit has been identified at time of analysis and no CISA KEV listing exists; the primary real-world risk is denial of service against embedded or IoT devices with TCP networking and shell access exposed on an adjacent network segment.

Technical ContextAI

Zephyr's TCP2 stack (subsys/net/ip/tcp.c, CPE cpe:2.3:a:zephyrproject:zephyr:*:*:*:*:*:*:*:*) maintains a global singly-linked list of TCP connections protected by tcp_lock (a k_mutex). The function net_tcp_foreach() iterates this list using SYS_SLIST_FOR_EACH_CONTAINER_SAFE, which caches a pointer to the next list node before each iteration step. Prior to the fix, net_tcp_foreach() dropped tcp_lock before invoking the per-connection callback and reacquired it afterward, creating an unlocked window. Concurrently, tcp_conn_release() - invoked from the dedicated TCP work-queue thread when a connection's reference count reaches zero (e.g., remote FIN or RST) - unlinks the connection from the global list and calls k_mem_slab_free() on the connection object. If this teardown races against the iterator's cached 'next' pointer, the iterator advances into freed slab memory that may have been reallocated - a textbook CWE-416 (Use After Free). The commit diff confirms the fix: tcp_conn_release() now performs teardown under tcp_lock, and net_tcp_foreach() holds tcp_lock continuously across the callback, eliminating the race window.

RemediationAI

Apply the upstream fix from commit cd85e0e890ab89815c4cbc0a8fbc03a3efa84dc2 (https://github.com/zephyrproject-rtos/zephyr/commit/cd85e0e890ab89815c4cbc0a8fbc03a3efa84dc2), which restructures locking in tcp_conn_release() and net_tcp_foreach() to eliminate the race window. A specific tagged patched release version has not been independently confirmed - only the upstream commit is available at time of analysis; integrators building from the Zephyr repository should cherry-pick or rebase past this commit. Until patched, the most impactful compensating control is disabling the Zephyr network shell at build time (set CONFIG_NET_SHELL=n), which removes the 'net conn' command - one of the two confirmed entry points into net_tcp_foreach() - with no functional trade-off for production (non-diagnostic) builds. The second entry point, net_tcp_close_all_for_iface() triggered on interface-down, cannot be disabled without broader impact; restrict who can trigger interface state changes instead. Additionally, enforce strict adjacent-network segmentation (e.g., VLAN isolation, port-level access control) to limit the pool of peers able to initiate the TCP teardown side of the race. Refer to the GitHub advisory at https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-6c57-xfhw-j26x for vendor guidance.