CVE-2026-15891 NULL pointer dereference in Zephyr MQTT-SN client when removing a non-responsive gateway
A remote attacker can cause a denial of service in Zephyr MQTT-SN clients by triggering a null pointer dereference during gateway removal.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-15891?
CVE-2026-15891 is a high-severity vulnerability in zephyrproject zephyr, published on 13 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The MQTT-SN client keepalive handler process_ping() in subsys/net/lib/mqtt_sn/mqtt_sn.c removes the gateway record after PINGREQ retries are exhausted. It invoked SYS_SLIST_PEEK_HEAD_CONTAINER(&client->gateways, gw, next) but discarded the result. That macro is a pure expression that does not assign to gw, so gw retained its NULL initializer regardless of the list contents.
The code then dereferences the NULL gw (gw->gw_id) and passes it to mqtt_sn_gw_destroy(), reaching k_mem_slab_free(&gateways, NULL). With CONFIG_MEM_SLAB_POINTER_VALIDATE enabled this triggers k_panic(); in the default configuration it performs a write through the NULL pointer ((char )mem = slab->free_list;) and corrupts the slab free list. The outcome is a crash/kernel panic or, on targets where address 0 is writable, silent memory-allocator corruption.
The vulnerable branch runs whenever the connected MQTT-SN gateway fails to answer keepalive PINGREQs for the configured number of retries. This condition is controlled by the remote peer: a malicious or compromised gateway, or an on-path/adjacent attacker that advertises itself as a gateway and then stops responding (or blackholes the real gateway's PINGRESPs), forces the client into the defect. MQTT-SN runs over UDP and no authentication is required.
The impact is a remotely triggerable denial of service (availability) of the affected MQTT-SN client; there is no attacker-controlled data written. The sibling remover process_advertise() uses SYS_SLIST_FOR_EACH_CONTAINER_SAFE and is not affected. The fix assigns the macro's return value to gw.
Weakness: CWE-476
Which versions are affected by CVE-2026-15891?
How do I fix CVE-2026-15891?
No fix has been published for CVE-2026-15891 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-15891 being exploited?
There is no known exploitation of CVE-2026-15891 in the wild and no public exploit code.
Sources
Also known as GHSA-c4g8-4f9p-4746.