CVE-2026-10646

Name of the Vulnerable Software and Affected Versions Zephyr versions 4.0.0 through 4.4.0

Description The BSD-sockets getaddrinfo() implementation in subsys/net/lib/sockets/getaddrinfo.c contains a use-after-return flaw. The function passes a pointer to a stack-allocated state object getaddrinfo state as the user data for an asynchronous DNS resolver query. If the semaphore wait times out, the system retries the query without cancelling the previous one or resetting the semaphore. This leaves an active query slot in the resolver pointing to an out-of-scope stack frame. A subsequent DNS response or a delayed query-timeout can trigger dns resolve cb(), causing the system to write to the stale pointer. Since the 16-bit transaction ID used for matching responses is spoofable, a network-based attacker can cause memory corruption, leading to crashes or denial of service.

Recommendations Update Zephyr versions 4.0.0 through 4.4.0 to a version where the timed-out query is cancelled by name and type before retrying and the local semaphore is reset.