← Back

CVE-2026-5590

nvd nist
Published: Apr 5, 2026Modified: Jul 24, 2026

JSON object

Loading...
5.3
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Exploitability: 1.6 / Impact: 3.6
Source: NVD

Description

A race condition during TCP connection teardown can cause tcp_recv() to operate on a connection that has already been released. If tcp_conn_search() returns NULL while processing a SYN packet, a NULL pointer derived from stale context data is passed to tcp_backlog_is_full() and dereferenced without validation, leading to a crash.

Affected (1)

Zephyrproject
1 product
Zephyr
Configuration A
1 vulnerable
Vulnerable SoftwareAffected Versions
Zephyr
Up to 4.3.0

Related CWEs

CWE-476
NULL Pointer Dereference
The product dereferences a pointer that it expects to be valid but is NULL.

References (1)

Source: vulnerabilities@zephyrproject.org
ExploitPatchVendor Advisory

Timeline

No history available yet.