CVE-2026-10643

Name of the Vulnerable Software and Affected Versions Zephyr versions 3.6.0 through 4.4.0

Description An out-of-bounds write exists in the IP socket recvmsg() implementation within the insert pktinfo() function located in subsys/net/lib/sockets/sockets inet.c. The issue occurs because the validation of the user-supplied ancillary msg control buffer only considers the payload length and ignores the size of the aligned cmsg header. This allows a buffer within a specific size window to pass the check but still result in a fixed-size write of up to one cmsg header (~12 bytes) beyond the buffer's end. When CONFIG USERSPACE is enabled, the overflow corrupts kernel heap memory and can be triggered by an unprivileged userspace thread. In supervisor mode, it corrupts the caller's buffer. This path is reachable on a UDP/IP socket with IP PKTINFO, IPV6 RECVPKTINFO, hoplimit, or timestamping enabled when recvmsg() is called with an undersized control buffer and a datagram is received. Part of the overwritten data, specifically the destination IP in ipi addr, is influenced by the received packet.

Recommendations Update Zephyr versions 3.6.0 through 4.4.0 to a patched release that implements the NET CMSG SPACE(pktinfo len) capacity check and returns -ENOMEM when the buffer is too small.