Vulnerabilities

TI-2026-09157 CVE-2026-10655

Use-after-free race in SNTP async client when closing the socket while the socket service is still polling it

LOW 29

The asynchronous SNTP client in Zephyr (subsys/net/lib/sntp/sntp.c, sntp_close_async) closed the UDP socket file descriptor directly from the calling thread immediately after detaching it from the network socket service,…

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.0038 Published 2026-06-30 Fixed in 4.3.1, 4.4.2 CWE-416

TI-2026-09156 CVE-2026-10654

RFCOMM session-disconnect race leaks session/L2CAP and denies further RFCOMM service in Zephyr Bluetooth Classic

LOW 14

A race condition in the Zephyr Bluetooth Classic RFCOMM host stack (subsys/bluetooth/host/classic/rfcomm.c) mishandles a simultaneous bidirectional session disconnect.

CVSS 3.1LOW 3.1 Adjacent network No auth No interaction EPSS 0.00172 Published 2026-06-30 Fixed in 4.3.1, 4.4.2 CWE-362

TI-2026-09155 CVE-2026-10653

Non-atomic `net_buf` reference counts cause double-free / free-list corruption under concurrent unref

LOW 36

The Zephyr net_buf library (lib/net_buf/buf.c) manipulated both of its reference counts -- the per-header buf->ref and the per-data-block ref_count at the start of each variable/heap data allocation -- with plain non-ato…

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.00418 Published 2026-06-30 Fixed in 4.3.1, 4.4.2 CWE-415

Vulnerabilities

Filters

Use-after-free race in SNTP async client when closing the socket while the socket service is still polling it

RFCOMM session-disconnect race leaks session/L2CAP and denies further RFCOMM service in Zephyr Bluetooth Classic

Non-atomic `net_buf` reference counts cause double-free / free-list corruption under concurrent unref