Zephyr RTOS CVE-2026-10646

The target application must call the BSD-sockets getaddrinfo() against an asynchronous DNS resolver, and the socket-layer semaphore wait must time out (-EAGAIN) so the pre-fix retry path ('goto again') executes - which the advisory states happens when the resolver's timeout work is delayed by workqueue contention, or in the documented configuration where CONFIG_NET_SOCKETS_DNS_TIMEOUT exceeds CONFIG_NET_SOCKETS_DNS_BACKOFF_INTERVAL (the multi-retry case). The attacker must then deliver a UDP DNS response whose 16-bit transaction id matches the orphaned query (spoofable/replayable by an on- or off-path attacker), or rely on the resolver's own delayed query-timeout work to fire. Limiting factors: exploitation hinges on winning this race window (hence CVSS AC:H), requires the device to actually be resolving names, and reliable memory corruption (versus a crash) is constrained by what reused stack data the attacker can influence; no authentication or user interaction is required (PR:N/UI:N).

The CVSS 3.1 vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H (7.4 High) is internally consistent with the description: the trigger is network-influenceable (AV:N), needs no authentication (PR:N) or user interaction (UI:N), but depends on a timing race - the semaphore wait must time out due to workqueue contention or a specific multi-retry timeout configuration, and the attacker must land a response with a matching 16-bit id - which justifies AC:H. Impact is correctly modeled as no confidentiality loss (C:N) but high integrity/availability (I:H/A:H) via stack memory corruption and DoS. No EPSS score, KEV listing, or public POC was provided, so real-world exploitation pressure appears low-to-unproven today; the practical risk is dominated by reliability/DoS on devices that perform DNS resolution, with reliable code-controlled memory corruption being substantially harder than the crash case. The honest priority read: a genuine network-influenceable bug worth patching on internet-exposed or hostile-network embedded devices, but the AC:H race and absence of exploitation signals make it a measured rather than emergency patch for most fleets. Missing data to note explicitly: no EPSS, no KEV, no confirmed patched release tag - only a fix commit and a GHSA advisory.

An attacker on or off the network path observes or guesses that a Zephyr device is performing getaddrinfo() lookups and floods spoofed UDP DNS responses carrying matching 16-bit transaction ids while the device is under workqueue load or using the multi-retry timeout configuration. After the socket semaphore times out and the query is retried, a delayed callback fires against the freed stack frame and writes through the stale pointer, crashing the device or corrupting reused stack memory. No public exploit is identified at time of analysis, and CVSS AC:H reflects the timing/race precision required.