{ "document": { "category": "csaf_base", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE" } }, "lang": "en", "notes": [ { "category": "legal_disclaimer", "text": "The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this portal to enhance access to its information and vulnerabilities. The use of this information is subject to the following terms and conditions:\n\nThe vulnerabilities disclosed in this portal are gathered by NCSC-NL from a variety of open sources, which the user can retrieve from other platforms. NCSC-NL makes every reasonable effort to ensure that the content of this portal is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or real-time keeping up-to-date. NCSC-NL does not control nor guarantee the accuracy, relevance, timeliness or completeness of information obtained from these external sources. The vulnerabilities disclosed in this portal are intended solely for the convenience of professional parties to take appropriate measures to manage the risks posed to the cybersecurity. No rights can be derived from the information provided therein.\n\nNCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of the vulnerabilities disclosed in this portal. This includes damage resulting from the inaccuracy of incompleteness of the information contained in it.\nThe information on this page is subject to Dutch law. All disputes related to or arising from the use of this portal regarding the disclosure of vulnerabilities will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings." } ], "publisher": { "category": "coordinator", "contact_details": "cert@ncsc.nl", "name": "National Cyber Security Centre", "namespace": "https://www.ncsc.nl/" }, "title": "CVE-2026-10646", "tracking": { "current_release_date": "2026-09-06T15:10:10.766968Z", "generator": { "date": "2026-02-17T15:00:00Z", "engine": { "name": "V.E.L.M.A", "version": "1.7" } }, "id": "CVE-2026-10646", "initial_release_date": "2026-06-28T05:26:23.547380Z", "revision_history": [ { "date": "2026-06-28T05:26:23.547380Z", "number": "1", "summary": "CVE created.| Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| References created (2).| CWES updated (1)." }, { "date": "2026-06-28T05:26:30.523747Z", "number": "2", "summary": "NCSC Score created." }, { "date": "2026-06-28T05:38:45.164971Z", "number": "3", "summary": "Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| Products created (1).| References created (2).| CWES updated (1)." }, { "date": "2026-06-28T05:38:51.811004Z", "number": "4", "summary": "NCSC Score updated." }, { "date": "2026-06-28T07:35:07.875788Z", "number": "5", "summary": "NCSC Score updated." }, { "date": "2026-06-28T17:06:07.616537Z", "number": "6", "summary": "Source connected.| CVE status created. (valid)| EPSS created." }, { "date": "2026-06-28T17:06:18.510364Z", "number": "7", "summary": "NCSC Score updated." }, { "date": "2026-06-29T16:06:18.376612Z", "number": "8", "summary": "Unknown change." }, { "date": "2026-06-29T16:06:20.654941Z", "number": "9", "summary": "NCSC Score updated." }, { "date": "2026-07-06T20:27:56.209024Z", "number": "10", "summary": "Products created (1).| Product Identifiers created (1).| Exploits created (1)." }, { "date": "2026-07-06T20:27:58.895001Z", "number": "11", "summary": "NCSC Score updated." }, { "date": "2026-07-10T15:41:47.400447Z", "number": "12", "summary": "Source connected.| CVE status created. (valid)| EPSS created." }, { "date": "2026-07-10T15:41:48.999296Z", "number": "13", "summary": "NCSC Score updated." }, { "date": "2026-07-12T18:44:15.420633Z", "number": "14", "summary": "Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| Products connected (16).| References created (4).| CWES updated (1)." }, { "date": "2026-07-12T18:44:27.598419Z", "number": "15", "summary": "NCSC Score updated." }, { "date": "2026-07-14T20:04:25.872834Z", "number": "16", "summary": "Description removed for source.| Description created for source." }, { "date": "2026-07-14T20:04:39.238942Z", "number": "17", "summary": "NCSC Score updated." }, { "date": "2026-07-14T20:17:13.914083Z", "number": "18", "summary": "Description removed for source.| Description created for source." }, { "date": "2026-07-15T09:02:50.085225Z", "number": "19", "summary": "Description removed for source.| Description created for source." }, { "date": "2026-08-06T22:40:24.498205Z", "number": "20", "summary": "Products connected (1).| Products removed (1)." }, { "date": "2026-08-06T22:40:26.086124Z", "number": "21", "summary": "NCSC Score updated." }, { "date": "2026-08-11T15:11:53.354921Z", "number": "22", "summary": "Source connected.| CVE status created. (valid)| EPSS created." }, { "date": "2026-08-11T15:13:09.131499Z", "number": "23", "summary": "NCSC Score updated." }, { "date": "2026-08-24T15:57:56.530887Z", "number": "24", "summary": "EPSS updated." }, { "date": "2026-08-24T15:57:57.825348Z", "number": "25", "summary": "NCSC Score updated." }, { "date": "2026-09-02T10:45:46.384021Z", "number": "26", "summary": "EPSS updated." }, { "date": "2026-09-02T23:34:59.479169Z", "number": "27", "summary": "NCSC Score updated." }, { "date": "2026-09-03T14:38:16.630474Z", "number": "28", "summary": "EPSS updated." }, { "date": "2026-09-03T19:01:41.887372Z", "number": "29", "summary": "EPSS updated." }, { "date": "2026-09-04T15:47:42.358833Z", "number": "30", "summary": "EPSS updated." }, { "date": "2026-09-05T03:59:22.490101Z", "number": "31", "summary": "NCSC Score updated." }, { "date": "2026-09-05T15:45:34.874412Z", "number": "32", "summary": "EPSS updated." } ], "status": "interim", "version": "32" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:semver/3.7.0|<4.5.0", "product": { "name": "vers:semver/3.7.0|<4.5.0", "product_id": "CSAFPID-8807263" } }, { "category": "product_version_range", "name": "vers:unknown/>=4.0.0|<=4.4.1", "product": { "name": "vers:unknown/>=4.0.0|<=4.4.1", "product_id": "CSAFPID-8537767", "product_identification_helper": { "cpe": "cpe:2.3:o:zephyrproject:zephyr:*:*:*:*:*:*:*:*" } } } ], "category": "product_name", "name": "Zephyr" } ], "category": "vendor", "name": "Zephyrproject" }, { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:unknown/v4.0.0", "product": { "name": "vers:unknown/v4.0.0", "product_id": "CSAFPID-5604263" } }, { "category": "product_version_range", "name": "vers:unknown/v4.1.0", "product": { "name": "vers:unknown/v4.1.0", "product_id": "CSAFPID-5604267" } }, { "category": "product_version_range", "name": "vers:unknown/v4.1.0-rc1", "product": { "name": "vers:unknown/v4.1.0-rc1", "product_id": "CSAFPID-5604268" } }, { "category": "product_version_range", "name": "vers:unknown/v4.1.0-rc2", "product": { "name": "vers:unknown/v4.1.0-rc2", "product_id": "CSAFPID-5604269" } }, { "category": "product_version_range", "name": "vers:unknown/v4.1.0-rc3", "product": { "name": "vers:unknown/v4.1.0-rc3", "product_id": "CSAFPID-5604270" } }, { "category": "product_version_range", "name": "vers:unknown/v4.2.0", "product": { "name": "vers:unknown/v4.2.0", "product_id": "CSAFPID-8566770" } }, { "category": "product_version_range", "name": "vers:unknown/v4.2.0-rc1", "product": { "name": "vers:unknown/v4.2.0-rc1", "product_id": "CSAFPID-8566773" } }, { "category": "product_version_range", "name": "vers:unknown/v4.2.0-rc2", "product": { "name": "vers:unknown/v4.2.0-rc2", "product_id": "CSAFPID-8566772" } }, { "category": "product_version_range", "name": "vers:unknown/v4.2.0-rc3", "product": { "name": "vers:unknown/v4.2.0-rc3", "product_id": "CSAFPID-8566771" } }, { "category": "product_version_range", "name": "vers:unknown/v4.3.0", "product": { "name": "vers:unknown/v4.3.0", "product_id": "CSAFPID-8570147" } }, { "category": "product_version_range", "name": "vers:unknown/v4.3.0-rc1", "product": { "name": "vers:unknown/v4.3.0-rc1", "product_id": "CSAFPID-8570150" } }, { "category": "product_version_range", "name": "vers:unknown/v4.3.0-rc2", "product": { "name": "vers:unknown/v4.3.0-rc2", "product_id": "CSAFPID-8570149" } }, { "category": "product_version_range", "name": "vers:unknown/v4.3.0-rc3", "product": { "name": "vers:unknown/v4.3.0-rc3", "product_id": "CSAFPID-8570148" } }, { "category": "product_version_range", "name": "vers:unknown/v4.4.0-rc1", "product": { "name": "vers:unknown/v4.4.0-rc1", "product_id": "CSAFPID-8570146" } }, { "category": "product_version_range", "name": "vers:unknown/v4.4.0-rc2", "product": { "name": "vers:unknown/v4.4.0-rc2", "product_id": "CSAFPID-8570145" } }, { "category": "product_version_range", "name": "vers:unknown/v4.4.0-rc3", "product": { "name": "vers:unknown/v4.4.0-rc3", "product_id": "CSAFPID-8570144" } } ], "category": "product_name", "name": "zephyr" } ], "category": "vendor", "name": "zephyrproject-rtos" } ] }, "vulnerabilities": [ { "cve": "CVE-2026-10646", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "description", "text": "Zephyr's BSD-sockets getaddrinfo() implementation (subsys/net/lib/sockets/getaddrinfo.c) passes a pointer to a stack-allocated state object (struct getaddrinfo_state ai_state) as the user_data of an asynchronous DNS resolver query. The socket layer waits on a semaphore with a timeout deliberately set slightly longer than the resolver's own per-query timeout. When that semaphore wait nonetheless times out (-EAGAIN) - which can occur when the resolver's timeout work is delayed by workqueue contention, or in the documented multi-retry configuration where CONFIG_NET_SOCKETS_DNS_TIMEOUT exceeds CONFIG_NET_SOCKETS_DNS_BACKOFF_INTERVAL - the pre-fix code retries the query (goto again) without cancelling the previous one and without resetting the semaphore.\n\nThe previous query slot remains active in the resolver with its callback and the stack pointer as user_data, and ai_state->dns_id is overwritten so the stale query can no longer be cancelled. A subsequent DNS response delivered over UDP and matched by its 16-bit transaction id (in dispatcher_cb()/dns_read()), or the resolver's own delayed query-timeout work, then invokes dns_resolve_cb() against the now out-of-scope stack frame, writing through the stale pointer (state->status, state->idx, state->ai_arr[], and k_sem_give()).\n\nBecause the triggering response is network-delivered and its 16-bit id is spoofable/replayable by an on- or off-path attacker, this is a network-influenceable use-after-return that can corrupt reused stack memory, leading to crashes/denial of service or memory corruption.\n\nThe fix cancels the timed-out query by name and type before retrying and resets the local semaphore, eliminating the stale callback path. Affected: Zephyr v4.0.0 through v4.4.0.", "title": "nvd - https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-10646" }, { "category": "description", "text": "Zephyr's BSD-sockets getaddrinfo() implementation (subsys/net/lib/sockets/getaddrinfo.c) passes a pointer to a stack-allocated state object (struct getaddrinfo_state ai_state) as the user_data of an asynchronous DNS resolver query. The socket layer waits on a semaphore with a timeout deliberately set slightly longer than the resolver's own per-query timeout. When that semaphore wait nonetheless times out (-EAGAIN) - which can occur when the resolver's timeout work is delayed by workqueue contention, or in the documented multi-retry configuration where CONFIG_NET_SOCKETS_DNS_TIMEOUT exceeds CONFIG_NET_SOCKETS_DNS_BACKOFF_INTERVAL - the pre-fix code retries the query (goto again) without cancelling the previous one and without resetting the semaphore.\n\nThe previous query slot remains active in the resolver with its callback and the stack pointer as user_data, and ai_state->dns_id is overwritten so the stale query can no longer be cancelled. A subsequent DNS response delivered over UDP and matched by its 16-bit transaction id (in dispatcher_cb()/dns_read()), or the resolver's own delayed query-timeout work, then invokes dns_resolve_cb() against the now out-of-scope stack frame, writing through the stale pointer (state->status, state->idx, state->ai_arr[], and k_sem_give()).\n\nBecause the triggering response is network-delivered and its 16-bit id is spoofable/replayable by an on- or off-path attacker, this is a network-influenceable use-after-return that can corrupt reused stack memory, leading to crashes/denial of service or memory corruption.\n\nThe fix cancels the timed-out query by name and type before retrying and resets the local semaphore, eliminating the stale callback path. Affected: Zephyr v4.0.0 through v4.4.0.", "title": "osv - https://www.googleapis.com/download/storage/v1/b/osv-vulnerabilities/o/GIT%2FCVE-2026-10646.json?alt=media" }, { "category": "description", "text": "Zephyr's BSD-sockets getaddrinfo() implementation (subsys/net/lib/sockets/getaddrinfo.c) passes a pointer to a stack-allocated state object (struct getaddrinfo_state ai_state) as the user_data of an asynchronous DNS resolver query. The socket layer waits on a semaphore with a timeout deliberately set slightly longer than the resolver's own per-query timeout. When that semaphore wait nonetheless times out (-EAGAIN) - which can occur when the resolver's timeout work is delayed by workqueue contention, or in the documented multi-retry configuration where CONFIG_NET_SOCKETS_DNS_TIMEOUT exceeds CONFIG_NET_SOCKETS_DNS_BACKOFF_INTERVAL - the pre-fix code retries the query (goto again) without cancelling the previous one and without resetting the semaphore.\n\nThe previous query slot remains active in the resolver with its callback and the stack pointer as user_data, and ai_state->dns_id is overwritten so the stale query can no longer be cancelled. A subsequent DNS response delivered over UDP and matched by its 16-bit transaction id (in dispatcher_cb()/dns_read()), or the resolver's own delayed query-timeout work, then invokes dns_resolve_cb() against the now out-of-scope stack frame, writing through the stale pointer (state->status, state->idx, state->ai_arr[], and k_sem_give()).\n\nBecause the triggering response is network-delivered and its 16-bit id is spoofable/replayable by an on- or off-path attacker, this is a network-influenceable use-after-return that can corrupt reused stack memory, leading to crashes/denial of service or memory corruption.\n\nThe fix cancels the timed-out query by name and type before retrying and resets the local semaphore, eliminating the stale callback path. Affected: Zephyr v4.0.0 through v4.4.0.", "title": "cveprojectv5 - https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/10xxx/CVE-2026-10646.json" }, { "category": "other", "text": "0.00447", "title": "EPSS" }, { "category": "other", "text": "4.2", "title": "NCSC Score" }, { "category": "other", "text": "Is related to CWE-416 (Use After Free)", "title": "NCSC Score top increasing factors" }, { "category": "other", "text": "Is related to an uncommon product vendor, Is related to (a version of) an uncommon product, There is exploit data available from source Nvd, There is cwe data available from source Nvd", "title": "NCSC Score top decreasing factors" } ], "product_status": { "known_affected": [ "CSAFPID-8537767", "CSAFPID-5604263", "CSAFPID-5604267", "CSAFPID-5604268", "CSAFPID-5604269", "CSAFPID-5604270", "CSAFPID-8566770", "CSAFPID-8566771", "CSAFPID-8566772", "CSAFPID-8566773", "CSAFPID-8570144", "CSAFPID-8570145", "CSAFPID-8570146", "CSAFPID-8570147", "CSAFPID-8570148", "CSAFPID-8570149", "CSAFPID-8570150", "CSAFPID-8807263" ] }, "references": [ { "category": "external", "summary": "Source - first", "url": "https://api.first.org/data/v1/epss" }, { "category": "external", "summary": "Source - nvd", "url": "https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-10646" }, { "category": "external", "summary": "Source - cveprojectv5", "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/10xxx/CVE-2026-10646.json" }, { "category": "external", "summary": "Source - osv", "url": "https://www.googleapis.com/download/storage/v1/b/osv-vulnerabilities/o/GIT%2FCVE-2026-10646.json?alt=media" }, { "category": "external", "summary": "Source - ncscclear", "url": "https://vulnerabilities.ncsc.nl/manual/CVE-2026-10646" }, { "category": "external", "summary": "Reference - cveprojectv5; nvd; osv", "url": "https://github.com/zephyrproject-rtos/zephyr/commit/cd27da58eedb8d0fe380dd340b81ca5afa35de45" }, { "category": "external", "summary": "Reference - cveprojectv5; nvd; osv", "url": "https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-h752-vhmf-29w6" }, { "category": "external", "summary": "Reference - osv", "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/10xxx/CVE-2026-10646.json" }, { "category": "external", "summary": "Reference - osv", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-10646" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H", "baseScore": 7.4, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-5604263", "CSAFPID-5604267", "CSAFPID-5604268", "CSAFPID-5604269", "CSAFPID-5604270", "CSAFPID-8537767", "CSAFPID-8566770", "CSAFPID-8566771", "CSAFPID-8566772", "CSAFPID-8566773", "CSAFPID-8570144", "CSAFPID-8570145", "CSAFPID-8570146", "CSAFPID-8570147", "CSAFPID-8570148", "CSAFPID-8570149", "CSAFPID-8570150", "CSAFPID-8807263" ] } ], "title": "CVE-2026-10646" } ] }