CVE-2026-10655

Name of the Vulnerable Software and Affected Versions Zephyr versions 4.2.0 through 4.4.0

Description The asynchronous SNTP client contains a race condition in the sntp close async() function within subsys/net/lib/sntp/sntp.c. The issue occurs when a UDP socket file descriptor is closed directly from a calling thread immediately after being detached from the network socket service, without synchronization with the socket-service poll thread. Because the socket service thread polls sockets via zvfs poll and registers a k poll event pointing to the socket's net context without holding a reference, the net context object may be freed and reused while the poll thread still has a linked poller node. This leads to a use-after-free or object confusion of kernel poll structures. A network peer or off-path attacker can trigger this by dropping or delaying SNTP/NTP responses, potentially causing a denial of service through a networking thread crash or memory corruption.

Recommendations Update Zephyr versions 4.2.0 through 4.4.0 to a version where the close operation is deferred to the socket service thread via net socket service close() using NET SOCKET SERVICE CLOSE SOCKETS.