Zephyr RTOS EUVD-2026-36727

Two simultaneous conditions are required. First, net_tcp_foreach() must be executing: this is reached either (a) when a low-privilege user runs the 'net conn' network shell command (requiring CONFIG_NET_SHELL to be enabled, which is a non-default build option in production hardened builds, and requiring shell/CLI access on the device), or (b) when a network interface goes down, triggering net_tcp_close_all_for_iface(). Second, a remote peer on the same adjacent network segment (LAN, VLAN, or direct link - AV:A precludes internet-routed attack) must simultaneously cause a TCP connection's reference count to drop to zero by sending a FIN or RST - this is achievable with ordinary TCP traffic and requires no special attacker capability beyond network adjacency. The race window between these two events must be won (AC:H), making reliable exploitation timing-dependent rather than deterministic. Exploitation is further limited by the PR:L requirement: shell access or equivalent local privilege is needed to trigger the iterator path. The assigned CVSS vector marks C:N, but the description states that slab reuse can lead to information disclosure - defenders should treat confidentiality impact as a realistic secondary outcome, not a confirmed-absent risk.

The assigned CVSS 3.1 score of 4.8 (Medium) with vector AV:A/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H accurately reflects the significant exploitation barriers: the attacker must be on an adjacent network segment (AV:A, ruling out internet-scale scanning), must win a timing-dependent race condition (AC:H), and must have low-privilege access to invoke the shell command or trigger an interface-down event (PR:L). These three compounding factors make opportunistic mass exploitation implausible. However, the C:N metric warrants scrutiny - the CVE description explicitly identifies potential information disclosure if the freed slab slot is reallocated before the callback dereferences it; the CVSS vector appears to understate this risk. No EPSS data was supplied, no KEV listing exists, and no public exploit code has been identified - consistent with the high exploitation complexity. In constrained embedded environments (RTOS-based IoT devices, sensor nodes, industrial controllers) where Zephyr TCP networking is enabled and adjacent-network isolation is weak, the DoS impact is the dominant concern: crashing the TCP stack on a resource-constrained device may require a physical reboot with no automated recovery.

An attacker sharing a LAN segment with a Zephyr device establishes multiple TCP connections to it, then sends rapid RST packets to drive connection teardowns, while a low-privilege user (or automated diagnostic process) concurrently invokes the 'net conn' shell command, triggering net_tcp_foreach(). If the RST-driven tcp_conn_release() frees the iterator's cached next-pointer during the unlocked callback window, the iterator dereferences freed slab memory - either crashing the Zephyr device (requiring physical reboot) or, if the slab slot was reallocated for a new connection the attacker partially controls, causing the diagnostic callback to operate on attacker-influenced data. No public exploit code has been identified at time of analysis.