Zephyr RTOS CVE-2026-10657

CONFIG_MDNS_RESOLVER must be enabled at compile time - this is the primary gate and is not a default in all Zephyr build configurations. The hostname supplied to getaddrinfo(), dns_get_addr_info(), or dns_resolve_name() must have a final label suffix shorter than 7 bytes (e.g., .org, .com, .net, .io, or a trailing dot). A crash - rather than a silent benign over-read - additionally requires that the hostname buffer be tightly allocated with no trailing slack bytes (specifically, allocated via k_usermode_string_alloc_copy to exactly strlen+1 bytes) AND that the immediately adjacent memory region be unmapped (guard page, MPU memory-domain boundary, or address sanitizer shadow). In the majority of embedded Zephyr deployments without ASAN or strict MPU domain separation, neither crash condition is met and the over-read reads harmless padding. Exploitation is strictly limited to availability (device crash); the over-read bytes are explicitly never returned to the caller, eliminating any confidentiality impact regardless of memory layout.

CVSS 3.7 (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L) is well-calibrated for this vulnerability. The AC:H rating correctly captures that a crash requires two simultaneous runtime conditions beyond attacker control: the hostname buffer must be tightly allocated with no trailing slack (as produced by k_usermode_string_alloc_copy at exactly strlen+1 bytes), and the next allocation boundary must be unmapped. In typical Zephyr embedded deployments without ASAN instrumentation or strict MPU memory-domain isolation, the over-read lands in readable padding and does not fault. EPSS data is absent from the provided intelligence. No KEV listing and no POC availability confirm this is not under active exploitation. A notable data-quality conflict exists: the source tags include 'Information Disclosure', but the CVE description explicitly states 'The over-read bytes are never returned, so there is no information disclosure' - this tag should be disregarded as a tagging error. Real-world exploitability is further gated by the CONFIG_MDNS_RESOLVER compile-time flag, which constrains the affected population to firmware images specifically built with mDNS support.

An application on a Zephyr device resolves a hostname ending in .io or .org - for example, a parsed URL from a remote configuration push - triggering dns_resolve_name_internal() with CONFIG_MDNS_RESOLVER compiled in. If the hostname was copied via k_usermode_string_alloc_copy to a buffer of exactly strlen+1 bytes and the next allocation boundary is an unmapped guard page or MPU domain fence, the 1-2 byte over-read faults the processor, crashing the device. No public exploit code has been identified at time of analysis.