Zephyr RTOS CVE-2026-15891

The target device must be running Zephyr RTOS with the MQTT-SN client subsystem compiled in (CONFIG_MQTT_SN enabled) and must be in an active or connecting MQTT-SN session. Exploitation requires the attacker to either (1) control or compromise the legitimate MQTT-SN gateway the client is peered with, or (2) occupy an on-path or adjacent network position and either advertise a rogue gateway or suppress real PINGRESP UDP packets from the legitimate gateway. The trigger condition is the exhaustion of the client's PINGREQ retry count, which the attacker forces simply by not responding - no crafted packet payload is needed. MQTT-SN carries no built-in authentication, so gateway impersonation is ungated on UDP networks. Exploitation is limited to: devices using this specific Zephyr subsystem, sessions that are actively in the connected/ping state, and attackers with UDP-level access to the client (adjacent or gateway-compromise path).

The NVD-assigned CVSS 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) overstates the realistic attack vector: the description explicitly names an 'on-path/adjacent attacker' advertising a fake gateway or suppressing real PINGRESPs, which maps to AV:A rather than AV:N in practical exploitation. A pre-compromised remote gateway does provide a fully-network-remote path, but that path requires prior compromise of infrastructure, not just network reachability. AC:L is appropriate once the attacker holds the required adjacent position, since triggering the bug requires only withholding UDP responses for the retry window - no timing precision or heap grooming is needed. PR:N is correct because MQTT-SN specifies no client authentication mechanism. Impact is purely availability: no attacker-controlled data is written, and C:N/I:N are accurate. EPSS data is not provided; no KEV listing confirms active exploitation. The bug is trivially reproducible from the commit diff, but the footprint is constrained to Zephyr MQTT-SN deployments. Real-world priority is moderate: high for IoT fleets relying on Zephyr MQTT-SN connectivity, low for environments not using this subsystem.

An attacker on the same UDP network segment as a Zephyr MQTT-SN device broadcasts or unicasts a forged ADVERTISE packet, causing the client to register the attacker's endpoint as a gateway and connect to it. The attacker accepts the connection and then silently drops all PINGRESP packets. Once the client's PINGREQ retry counter is exhausted, process_ping() executes the gateway-removal path with a NULL gw pointer, crashing the device or corrupting its slab allocator - taking the IoT node offline. No exploit code is publicly known, but the fix is a single-line diff making independent reproduction trivial.