{"schema":"threatline.record/2","record":{"id":"CVE-2026-18417","aliases":["GHSA-p8r8-8mw8-3wf9"],"summary":"Wild pointer dereference in Zephyr BSD sockets when a TCP listening socket reports an asynchronous error","details":"The native BSD-socket layer recorded a pending asynchronous socket error by type-punning it into struct net_context's void user_data field (ctx->user_data = INT_TO_POINTER(-status) in zsock_accepted_cb(), zsock_received_cb(), zsock_connected_cb() and zsock_close_ctx() in subsys/net/lib/sockets/sockets_inet.c), reading it back with POINTER_TO_INT(). That same field is owned by the network stack for listening TCP contexts: net_tcp_accept() stores the parent context pointer there and the TCP core passes it back to the registered accept callback. A failed accept therefore left a small integer (an errno value) where the stack expected a struct net_context .\n\nWhen the network interface carrying a listening TCP socket goes down, close_tcp_conn() in subsys/net/ip/tcp.c invokes the accept callback with -ENETDOWN and the context's user_data. In v4.3.0 the callback was not disarmed afterwards, so a second interface-down event forwarded the previously stored errno to zsock_accepted_cb(), which dereferenced it as the parent context and performed several stores through it (sock_set_error()'s read-modify-write of socket_data, k_fifo_cancel_wait(&parent->recv_q)) — the crash described in the fix's commit message. v4.3.1 and v4.4.x carry a later change clearing conn->accept_cb after the error callback (269cb8823d3 on the v4.3 branch, 913fae5169425550f2364655298fceb79b320066 on main), which closes that repeat path; on those releases the poisoned cookie remains reachable only by a narrower race, a handshake completing alongside the interface-down still passing the stale cookie to k_fifo_put(&parent->accept_q, ...), and by getsockopt(SO_ERROR), which reads the field back unconditionally.\n\nOn v4.3.0 an application that keeps a listening TCP socket open across repeated link-down events is sufficient to reach the defect; the triggering condition is a network-interface state change, not attacker-supplied packet data, so the practical attacker is one able to force the link down repeatedly (for example an adjacent attacker disrupting a wireless link) or one with local/physical access. Because both the faulting address and the stored data are fixed small constants derived from the errno value, the outcome is a wild-pointer access leading to a kernel fatal error — a denial of service (device crash or reset) rather than an attacker-directed memory corruption.\n\nThe fix stores the pending error in a dedicated net_context.sock_error field and converts every producer and consumer to sock_set_error()/sock_get_error(), leaving user_data untouched. As a side effect it also stops getsockopt(SO_ERROR) — which is evaluated unconditionally — from returning the kernel address held in user_data to a userspace application.","categories":["Unclassified"],"product":"zephyr","vendor":"zephyrproject","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-18417","source_modified_at":"2026-09-30T13:43:48.703Z","fetched_at":"2026-10-23T18:52:38.922436Z","product":"zephyr","vendor":"zephyrproject","versions":[{"version":"4.3.0","status":"affected","versionType":"semver","lessThan":"4.4.2"}],"defaultStatus":"unaffected"}],"fixed_versions":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-18417","source_modified_at":"2026-09-30T13:43:48.703Z","fetched_at":"2026-10-23T18:52:38.922436Z","package":{"name":"zephyr","ecosystem":null},"version":"4.4.2","basis":"first unaffected version stated in the CVE record"}],"cvss":6.5,"severity":"Medium","kev":{"listed":false},"epss":{"probability":0.00175,"percentile":0.06595,"score_date":"2026-10-23"},"published_at":"2026-09-28T23:25:23.903Z","modified_at":"2026-09-30T13:43:48.703Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-18417","fetched_at":"2026-10-23T18:52:38.922436Z","source_modified_at":"2026-09-30T13:43:48.703Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-18417","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CVE List","EPSS"],"references":[{"source":"CVE List","url":"https://github.com/zephyrproject-rtos/zephyr/commit/ef370a57d07637aaee8cec7b0bcebf4002ac8f54","tags":["patch"]},{"source":"CVE List","url":"https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-p8r8-8mw8-3wf9"}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","ssvc":{"exploitation":"none","automatable":"no","technical_impact":"partial","assessed_at":"2026-09-30T13:43:32.816350Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-09-30T13:43:48.703Z","content_hash":"9d6c01eca98c3007e23383734b0ac3ffab36d7f5864f580c562e4693a53e0c9f"}}