CVE-2026-10634

Name of the Vulnerable Software and Affected Versions Zephyr versions prior to 4.4.1

Description The native TCP stack contains a use-after-free flaw when iterating the global connection list in the net tcp foreach() function. The issue occurs because the function releases the tcp lock while invoking a per-connection callback. A concurrent tcp conn release() function, triggered when a connection reference count reaches zero, can remove and free the cached next connection using k mem slab free(). When the iterator subsequently dereferences this freed memory, it can lead to a system crash (denial of service) or allow a callback to operate on an attacker-influenced object, potentially resulting in information disclosure. This behavior is triggered via the 'net conn' network shell command or the net tcp close all for iface() function during an interface-down event.

Recommendations Update to version 4.4.1 or later to ensure the connection teardown in tcp conn release() is performed within the tcp lock critical section and the lock is held across callbacks in net tcp foreach().