{"answers":{"affected":"","exploited":"There is no known exploitation of CVE-2026-15924 in the wild and no public exploit code.","fix":"No fix has been published for CVE-2026-15924 yet. Limit exposure of the affected software until one is available.","what":"CVE-2026-15924 is a medium-severity use after free vulnerability in zephyrproject zephyr, published on 14 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-15924 and fix it if it is affected.\n\nWhat it is: CVE-2026-15924 is a medium-severity use after free vulnerability in zephyrproject zephyr, published on 14 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2026-15924 in the wild and no public exploit code.\n\nAffected product: zephyrproject zephyr. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-15924/ (Markdown: https://insights.sbomify.com/CVE-2026-15924/index.md)","id":"CVE-2026-15924","markdown":"https://insights.sbomify.com/CVE-2026-15924/index.md","name":"CVE-2026-15924","record":{"aliases":["GHSA-wcgm-pq6x-v2gf"],"analysis":{"component_type":"operating_system","fix_type":"patch","impacts":["denial_of_service"],"network_reachable":"yes","non_default_config":true,"product_category":"Zephyr RTOS","requires_auth":"none","summary":"Concurrent TLS client connections can trigger use-after-free or double-free in the session cache, causing crashes or heap corruption in Zephyr RTOS.","user_interaction":"not_required","vuln_class":"use_after_free"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"zephyr","cpe":[],"cvss":{"score":5.9,"severity":"medium","source":"cna","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"cwes":[{"id":"CWE-416","name":"Use After Free"}],"description":"Zephyr's TLS socket layer in subsys/net/lib/sockets/sockets_tls.c keeps a single process-global array, client_cache, of cached client sessions that is shared by every TLS socket context. The functions that mutate and read it — tls_session_save(), tls_session_get(), tls_session_cache_reset(), and the settings restore handler — allocate, free, and dereference each entry's heap buffer (entry-\u003esession). Before the fix these accesses were serialized only by the per-socket context mutex ctx-\u003elock (assigned per socket in ctx_set_lock()), which provides no mutual exclusion between different sockets touching the shared cache.\n\nBecause CONFIG_NET_SOCKETS_TLS_MAX_CLIENT_SESSION_COUNT defaults to 1, any two concurrent client sockets contend for the same slot. A thread in tls_session_get() reading entry-\u003esession inside mbedtls_ssl_session_load() can run concurrently with another thread in tls_session_save() that selects the same entry for reuse and executes mbedtls_free(entry-\u003esession) before reallocating — a use-after-free read, and a double-free when two saves evict the same entry. Both corrupt the mbedTLS heap. The cache is reached on ordinary client paths: at connect time via tls_session_store()/tls_session_restore(), and (on main) whenever a TLS 1.3 session ticket arrives during recv()/poll() via tls_session_store_current().\n\nExploitation requires an application that opts into per-socket client session caching (the TLS_SESSION_CACHE socket option, off by default) and runs concurrent TLS client connections on multiple threads; the timing that opens the window is influenced by the remote peer(s), so a malicious or compromised server can raise session-ticket frequency to widen it. The reliably-demonstrable impact is memory corruption leading to a crash or heap corruption (denial of service). The fix adds a dedicated session_cache_lock mutex taken across every accessor of client_cache, serializing all reads and frees and closing the race.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":false,"headline":"Use-after-free / double-free from unsynchronized concurrent access to the TLS client session cache in Zephyr sockets","id":"CVE-2026-15924","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"use_after_free","year":"2026"},"n_packages":0,"n_references":2,"next":{"headline":"Improper TLS Hostname Verification in Snowflake Connector for Python","id":"CVE-2026-15925"},"packages":[],"prev":{"headline":"Infinite loop denial of service in Zephyr SDIO byte-I/O from a card-supplied zero max_blk_size","id":"CVE-2026-15923"},"products":["zephyr"],"published":"2026-09-14","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"no","exploitation":"none","technical_impact":"partial"},"state":"PUBLISHED","updated":"2026-09-14","vendors":["zephyrproject"]},"summary":"Concurrent TLS client connections can trigger use-after-free or double-free in the session cache, causing crashes or heap corruption in Zephyr RTOS.","url":"https://insights.sbomify.com/CVE-2026-15924/"}