CVE-2026-8718

Name of the Vulnerable Software and Affected Versions Zephyr versions 3.5.0 and later

Description An out-of-bounds write exists in the tls opt dtls peer connection id value get() function within subsys/net/lib/sockets/sockets tls.c. This function handles the getsockopt(SOL TLS, TLS DTLS PEER CID VALUE) call and passes the caller-supplied optval to mbedtls ssl get peer cid() without verifying that the buffer is at least MBEDTLS SSL CID OUT LEN MAX (default 32) bytes. Because mbedtls ssl get peer cid() copies the peer-negotiated DTLS Connection ID into the buffer without a destination-size parameter, providing an optlen smaller than the Connection ID results in a write of up to 31 bytes beyond the buffer end. In builds using CONFIG USERSPACE, the getsockopt syscall verifier z vrfy zsock getsockopt allocates a kernel buffer of exactly optlen bytes via k usermode alloc from copy and z thread malloc. Consequently, an unprivileged user thread can trigger a kernel-heap buffer overflow by passing a small optlen on a connected DTLS socket with Connection ID enabled. This issue requires CONFIG MBEDTLS SSL DTLS CONNECTION ID, an established DTLS session with a negotiated peer CID, and CONFIG USERSPACE for the kernel-crossing scenario.

Recommendations Update Zephyr to a version where the tls opt dtls peer connection id value get() function rejects callers with an optlen below MBEDTLS SSL CID OUT LEN MAX by returning -EINVAL.