What is the CVSS score of CVE-2026-5590?

CVE-2026-5590 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

Zephyr CVE-2026-5590

EUVD-2026-19028 MEDIUM

NULL Pointer Dereference (CWE-476)

2026-04-05 zephyr

Null Pointer Dereference Denial Of Service Zephyr

5.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.3 MEDIUM

AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

CVSS changed

Jul 08, 2026 - 13:52 NVD

6.4 (MEDIUM) 5.3 (MEDIUM)

EUVD ID Assigned

Apr 05, 2026 - 04:00 euvd

EUVD-2026-19028

Analysis Generated

Apr 05, 2026 - 04:00 vuln.today

CVE Published

Apr 05, 2026 - 03:34 nvd

MEDIUM 6.4

DescriptionNVD

A race condition during TCP connection teardown can cause tcp_recv() to operate on a connection that has already been released. If tcp_conn_search() returns NULL while processing a SYN packet, a NULL pointer derived from stale context data is passed to tcp_backlog_is_full() and dereferenced without validation, leading to a crash.

AnalysisAI

Null pointer dereference in Zephyr RTOS TCP stack during connection teardown allows authenticated remote attackers to cause denial of service. A race condition in tcp_recv() processing of SYN packets causes tcp_conn_search() to return NULL on a released connection, which is then dereferenced without validation in tcp_backlog_is_full(), resulting in a crash. The vulnerability requires low-privilege authentication and is moderately complex to trigger due to timing constraints (AC:H), but results in high availability impact.

Technical ContextAI

Zephyr RTOS implements a TCP/IP stack that manages connection lifecycle through connection object pointers stored in context structures. The vulnerability stems from CWE-476 (Null Pointer Dereference) in the connection teardown path: during SYN packet processing, if a connection has been concurrently released, tcp_conn_search() correctly returns NULL to indicate the connection no longer exists. However, the calling function tcp_recv() does not validate this NULL return before passing the dereferenced pointer to tcp_backlog_is_full(). The race condition window opens between connection release and subsequent SYN packet arrival, allowing stale context pointers to be used. This affects all Zephyr versions implementing the vulnerable TCP connection management logic.

RemediationAI

Update Zephyr RTOS to the patched version released by the Zephyr project. The exact patched version number should be obtained from the Zephyr GitHub security advisory at https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-4vqm-pw24-g9jp. The fix adds null-pointer validation in tcp_recv() before dereferencing the connection pointer returned by tcp_conn_search(), ensuring that NULL returns are handled safely rather than passed to tcp_backlog_is_full(). For systems unable to update immediately, restrict authenticated network access to TCP services on affected Zephyr devices where possible, or isolate devices to trusted networks only. Validate that your Zephyr build includes TCP stack updates when patching.