Zephyr RTOS CVE-2026-10655

The vulnerable code path is reached only when the Zephyr SNTP client is compiled in and active (subsys/net/lib/config/init_clock_sntp.c with CONFIG_NET_CONFIG_CLOCK_SNTP_INIT enabled). The race specifically requires that the SNTP timeout handler fires - meaning the configured NTP server does not respond within the timeout window - which can be engineered by any attacker able to drop or delay UDP port 123 traffic on the path between the device and its NTP server. The socket-service poll thread must be concurrently blocked in k_poll on the same socket file descriptor, which is the normal steady state during SNTP synchronization. Periodic resync via NET_CONFIG_SNTP_INIT_RESYNC creates repeated, scheduled exploitation windows. Exploitation is limited to Zephyr v4.2.0-v4.4.0 specifically; the CVSS vector confirms no authentication is required (PR:N) and no user interaction is needed (UI:N), but the race-condition timing requirement (AC:H) means exploitation is not trivially reliable on first attempt. There is no known exploitation of this issue from configuration requiring local access; it is a pure network-path condition.

The NVD-assigned CVSS 3.1 score of 6.5 (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H) correctly captures the principal risk signals: the attack is network-reachable with no required privileges or user interaction, but the High Attack Complexity (AC:H) reflects the race-condition timing requirement. No EPSS score was provided in the intelligence data; given the absence of a public exploit and no CISA KEV listing, real-world exploitation probability at this moment is likely low-to-moderate despite the network vector. The Integrity:Low metric accounts for the speculative but technically plausible memory-corruption scenario if the freed context slot is reused; the primary confirmed impact is availability. The SNTP timeout path is a normal, periodic failure mode rather than an edge case, which raises practical exploitability: an attacker need only suppress UDP port 123 responses (trivial on a network path), and periodic resync (NET_CONFIG_SNTP_INIT_RESYNC) gives repeated windows. Defenders should weigh that SNTP is often considered low-risk infrastructure, but on Zephyr-based embedded devices - where crashing the networking thread may brick connectivity entirely - the operational impact can be severe. EPSS data is absent from available intelligence; exploitation timing assessment is inferred from CVSS vector and description only.

An attacker positioned on the network path between the Zephyr device and its configured NTP server - or controlling a rogue NTP server - drops or never responds to SNTP UDP packets. After the SNTP timeout expires, the system workqueue invokes sntp_close_async concurrently with the socket-service poll thread blocking in k_poll on the same socket, triggering the use-after-free race; repeated periodic resyncs (NET_CONFIG_SNTP_INIT_RESYNC) give the attacker recurring exploitation windows. The most reliable outcome is a networking thread crash and loss of connectivity on the embedded device; on faster pool reallocation paths, memory corruption affecting adjacent net_context users is also possible.