Ofir Shemesh

**Name of the Vulnerable Software and Affected Versions** Zephyr versions prior to 4.4.1 **Description** The native TCP stack contains a use-after-free flaw when iterating the global connection list in the `net tcp foreach()` function. The issue occurs because the function releases the `tcp lock` while invoking a per-connection callback. A concurrent `tcp conn release()` function, triggered when a connection reference count reaches zero, can remove and free the cached next connection using `k mem slab free()`. When the iterator subsequently dereferences this freed memory, it can lead to a system crash (denial of service) or allow a callback to operate on an attacker-influenced object, potentially resulting in information disclosure. This behavior is triggered via the 'net conn' network shell command or the `net tcp close all for iface()` function during an interface-down event. **Recommendations** Update to version 4.4.1 or later to ensure the connection teardown in `tcp conn release()` is performed within the `tcp lock` critical section and the lock is held across callbacks in `net tcp foreach()`.