Zephyr CVE-2026-5590

CVSS 6.4 (AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H) indicates moderate real-world risk with several mitigating factors. Attack vector is network-accessible, but attack complexity is HIGH, meaning the race condition requires precise timing or multiple attempts to trigger reliably. Low privilege requirement (PR:L) means only authenticated network actors can exploit this, reducing exposure compared to unauthenticated remote code execution. The availability impact is rated HIGH due to kernel crash, but confidentiality and integrity impacts are LOW. EPSS probability data not provided, so real-world exploitation likelihood cannot be quantified independently. KEV status not confirmed, suggesting this is not yet observed in active exploitation campaigns. The AC:H rating is the primary risk reducer-while the bug is real and causes crashes, triggering it requires timing precision that may not be reliable in production networks. This should be prioritized for patching in systems where authenticated remote TCP access is possible, but is not an emergency-level threat.

An authenticated remote attacker on the same network as a Zephyr RTOS device establishes a TCP connection, then rapidly closes it while simultaneously sending a SYN packet to initiate a new connection. Due to the race condition, the SYN packet is processed by tcp_recv() while the prior connection is being released by the TCP stack. The stale connection pointer in context data is passed to tcp_backlog_is_full() without null validation, dereferencing NULL and triggering a kernel panic. The attacker would need to time or repeat this sequence multiple times due to AC:H complexity, but each successful collision crashes the device, resulting in denial of service. No public exploit code is referenced in available data.