# CVE-2026-18417: Wild pointer dereference in Zephyr BSD sockets when a TCP listening socket reports an asynchronous error > A wild pointer dereference in Zephyr's BSD sockets layer causes a crash when a TCP listening socket encounters repeated asynchronous errors during interface state changes. - **Severity:** Medium 6.5 (`CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H`) - **Exploited in the wild:** Not known - **Login needed:** Not needed - **Attackable:** Local or same network only - **Victim action needed:** Not needed - **Fix available:** No - **Published:** 28 Sep 2026 - **Updated:** 30 Sep 2026 - **Also known as:** GHSA-p8r8-8mw8-3wf9 ## What is CVE-2026-18417? CVE-2026-18417 is a medium-severity vulnerability in zephyrproject zephyr, published on 28 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim. ### Official description The native BSD-socket layer recorded a pending asynchronous socket error by type-punning it into struct net_context's void user_data field (ctx->user_data = INT_TO_POINTER(-status) in zsock_accepted_cb(), zsock_received_cb(), zsock_connected_cb() and zsock_close_ctx() in subsys/net/lib/sockets/sockets_inet.c), reading it back with POINTER_TO_INT(). That same field is owned by the network stack for listening TCP contexts: net_tcp_accept() stores the parent context pointer there and the TCP core passes it back to the registered accept callback. A failed accept therefore left a small integer (an errno value) where the stack expected a struct net_context . When the network interface carrying a listening TCP socket goes down, close_tcp_conn() in subsys/net/ip/tcp.c invokes the accept callback with -ENETDOWN and the context's user_data. In v4.3.0 the callback was not disarmed afterwards, so a second interface-down event forwarded the previously stored errno to zsock_accepted_cb(), which dereferenced it as the parent context and performed several stores through it (sock_set_error()'s read-modify-write of socket_data, k_fifo_cancel_wait(&parent->recv_q)) — the crash described in the fix's commit message. v4.3.1 and v4.4.x carry a later change clearing conn->accept_cb after the error callback (269cb8823d3 on the v4.3 branch, 913fae5169425550f2364655298fceb79b320066 on main), which closes that repeat path; on those releases the poisoned cookie remains reachable only by a narrower race, a handshake completing alongside the interface-down still passing the stale cookie to k_fifo_put(&parent->accept_q, ...), and by getsockopt(SO_ERROR), which reads the field back unconditionally. On v4.3.0 an application that keeps a listening TCP socket open across repeated link-down events is sufficient to reach the defect; the triggering condition is a network-interface state change, not attacker-supplied packet data, so the practical attacker is one able to force the link down repeatedly (for example an adjacent attacker disrupting a wireless link) or one with local/physical access. Because both the faulting address and the stored data are fixed small constants derived from the errno value, the outcome is a wild-pointer access leading to a kernel fatal error — a denial of service (device crash or reset) rather than an attacker-directed memory corruption. The fix stores the pending error in a dedicated net_context.sock_error field and converts every producer and consumer to sock_set_error()/sock_get_error(), leaving user_data untouched. As a side effect it also stops getsockopt(SO_ERROR) — which is evaluated unconditionally — from returning the kernel address held in user_data to a userspace application. Weakness: CWE-843 (Access of Resource Using Incompatible Type) ## Which versions are affected by CVE-2026-18417? ## How do I fix CVE-2026-18417? No fix has been published for CVE-2026-18417 yet. Limit exposure of the affected software until one is available. ## Is CVE-2026-18417 being exploited? There is no known exploitation of CVE-2026-18417 in the wild and no public exploit code. ## Fix prompt for AI coding agents ```text Check this codebase for CVE-2026-18417 and fix it if it is affected. What it is: CVE-2026-18417 is a medium-severity vulnerability in zephyrproject zephyr, published on 28 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim. Exploitation: There is no known exploitation of CVE-2026-18417 in the wild and no public exploit code. Affected product: zephyrproject zephyr. No package-level version data is available, so check the vendor advisory linked from the reference page. Task: 1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies. 2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it. 3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead. 4. Run the tests and summarise what changed and why. 5. If nothing in the project is affected, say so and change nothing. Reference: https://insights.sbomify.com/CVE-2026-18417/ (Markdown: https://insights.sbomify.com/CVE-2026-18417/index.md) ``` ## Sources - CVE record: https://www.cve.org/CVERecord?id=CVE-2026-18417 - NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-18417 - OSV: https://osv.dev/vulnerability/CVE-2026-18417 --- From sbomify Insights: https://insights.sbomify.com/CVE-2026-18417/ Summaries are generated and may contain mistakes; the official description above is the record.