{"answers":{"affected":"","exploited":"There is no known exploitation of CVE-2026-15891 in the wild and no public exploit code.","fix":"No fix has been published for CVE-2026-15891 yet. Limit exposure of the affected software until one is available.","what":"CVE-2026-15891 is a high-severity vulnerability in zephyrproject zephyr, published on 13 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-15891 and fix it if it is affected.\n\nWhat it is: CVE-2026-15891 is a high-severity vulnerability in zephyrproject zephyr, published on 13 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2026-15891 in the wild and no public exploit code.\n\nAffected product: zephyrproject zephyr. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-15891/ (Markdown: https://insights.sbomify.com/CVE-2026-15891/index.md)","id":"CVE-2026-15891","markdown":"https://insights.sbomify.com/CVE-2026-15891/index.md","name":"CVE-2026-15891","record":{"aliases":["GHSA-c4g8-4f9p-4746"],"analysis":{"component_type":"operating_system","fix_type":"patch","impacts":["denial_of_service"],"network_reachable":"yes","non_default_config":false,"product_category":"Zephyr RTOS","requires_auth":"none","summary":"A remote attacker can cause a denial of service in Zephyr MQTT-SN clients by triggering a null pointer dereference during gateway removal.","user_interaction":"not_required","vuln_class":"null_dereference"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"zephyr","cpe":[],"cvss":{"score":7.5,"severity":"high","source":"cna","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"cwes":[{"id":"CWE-476","name":"NULL Pointer Dereference"}],"description":"The MQTT-SN client keepalive handler process_ping() in subsys/net/lib/mqtt_sn/mqtt_sn.c removes the gateway record after PINGREQ retries are exhausted. It invoked SYS_SLIST_PEEK_HEAD_CONTAINER(\u0026client-\u003egateways, gw, next) but discarded the result. That macro is a pure expression that does not assign to gw, so gw retained its NULL initializer regardless of the list contents.\n\nThe code then dereferences the NULL gw (gw-\u003egw_id) and passes it to mqtt_sn_gw_destroy(), reaching k_mem_slab_free(\u0026gateways, NULL). With CONFIG_MEM_SLAB_POINTER_VALIDATE enabled this triggers k_panic(); in the default configuration it performs a write through the NULL pointer ((char )mem = slab-\u003efree_list;) and corrupts the slab free list. The outcome is a crash/kernel panic or, on targets where address 0 is writable, silent memory-allocator corruption.\n\nThe vulnerable branch runs whenever the connected MQTT-SN gateway fails to answer keepalive PINGREQs for the configured number of retries. This condition is controlled by the remote peer: a malicious or compromised gateway, or an on-path/adjacent attacker that advertises itself as a gateway and then stops responding (or blackholes the real gateway's PINGRESPs), forces the client into the defect. MQTT-SN runs over UDP and no authentication is required.\n\nThe impact is a remotely triggerable denial of service (availability) of the affected MQTT-SN client; there is no attacker-controlled data written. The sibling remover process_advertise() uses SYS_SLIST_FOR_EACH_CONTAINER_SAFE and is not affected. The fix assigns the macro's return value to gw.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":false,"headline":"NULL pointer dereference in Zephyr MQTT-SN client when removing a non-responsive gateway","id":"CVE-2026-15891","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"null_dereference","year":"2026"},"n_packages":0,"n_references":2,"next":{"headline":"Heap memory leak in mcumgr settings-management handlers on access-hook rejection leads to denial of service","id":"CVE-2026-15892"},"packages":[],"prev":{"headline":"AEAD nonce reuse in Zephyr secure_storage ITS default nonce provider due to missing thread synchronization","id":"CVE-2026-15890"},"products":["zephyr"],"published":"2026-09-13","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"no","exploitation":"none","technical_impact":"partial"},"state":"PUBLISHED","updated":"2026-09-14","vendors":["zephyrproject"]},"summary":"A remote attacker can cause a denial of service in Zephyr MQTT-SN clients by triggering a null pointer dereference during gateway removal.","url":"https://insights.sbomify.com/CVE-2026-15891/"}