VulnSocial

CVE-2026-10643Disclosure(zephyrproject / zephyr)

LOWCVSS 7.8 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Patch zephyrproject zephyr systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Zephyr's IP socket recvmsg() implementation (subsys/net/lib/sockets/sockets_inet.c, insert_pktinfo()) validated the user-supplied ancillary (msg_control) buffer using only the payload length (msg->msg_controllen < pktinfo_len) before writing a full control message consisting of an aligned cmsg header plus the payload. Because the check omitted the cmsg header size, a control buffer whose length falls in the under-checked window (e.g. 16-27 bytes for IPv4 IP_PKTINFO on a 64-bit target, where a single element actually occupies 28 bytes) passes the guard yet causes a fixed-size out-of-bounds write of up to one cmsg header (~12 bytes) past the end of the buffer. Under CONFIG_USERSPACE the recvmsg verifier allocates a kernel-heap copy of the control buffer sized to msg_controllen and runs the implementation against it, so the overflow corrupts kernel heap memory and is triggerable from an unprivileged userspace thread; in supervisor mode it corrupts the caller's buffer. The path is reachable on a UDP/IP socket with IP_PKTINFO/IPV6_RECVPKTINFO (or hoplimit/timestamping) enabled when the application calls recvmsg() with an undersized control buffer and a datagram is received; part of the overwritten bytes (the destination IP in ipi_addr) is influenced by the received packet. The fix makes the capacity check use NET_CMSG_SPACE(pktinfo_len) (aligned header + aligned data) and returns -ENOMEM when the buffer is too small. Affected: v3.6.0 through v4.4.0.

zephyrproject CVEsBack to dashboard
0.5/ 10 priority

Sources & remediation

Patch / fix
Other references
Weakness type (CWE)
CWE-787

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • zephyr

Threat summary

  • Patch or workaround signal is available
  • 3 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 3 signals
  • Disclosure: 2 classified signals
  • Peaked 1d ago at 2 mentions (2026-06-28); latest day: 1
  • 3 total mentions across 2 days

Affected systems

Vendors
zephyrproject
Products
zephyr

Deep dive

Activity timeline3 mentions / 2d
01122Mentions · 2026-06-28: 2Mentions · 2026-07-03: 1Patch / Workaround · 2026-06-28: 1Technical Details · 2026-06-28: 2Technical Details · 2026-07-03: 106-2807-03
Signal classification2 categories
Disclosure
266.7%
Patch
133.3%
Referenced assets1 URL
By indicator
Classification over time
DateTotalLabels
2026-06-282
Disclosure1Patch1
2026-07-031
Disclosure1
Full discourse3 posts
  • YogSotho@YogSoth0
    Disclosure

    # CVE-2026-10643 #Zephyr RTOS recvmsg() Heap Out-of-Bounds Write Exploit Kit - **Affected**: Zephyr v3.6.0 – v4.4.0 - **Component**: `subsys/net/lib/sockets/sockets_inet.c` (`insert_pktinfo()`) - **Impact**: Kernel heap memory corruption, exploitable from unprivileged threads under `CONFIG_USERSPACE` - **Requirements**: `IP_PKTINFO` / `IPV6_RECVPKTINFO` enabled, UDP socket, `recvmsg()` with undersized control buffer #0days #exploit #CVE #cybersecurity #hacking #security #antisec #infosec

    Post summary

    The text discloses a heap out‑of‑bounds write in Zephyr RTOS (CVE‑2026‑10643), listing affected versions, impact, and conditions, and notes an exploit kit without providing exploit code or a patch.

    1302051.2K
    1.9K followersView on X
  • Upwind Security MDR@UpwindMDR
    Patch

    🚨 HIGH - Zephyr RTOS recvmsg() ancillary data OOB write (CVE-2026-10643) Zephyr RTOS is vulnerable to an out-of-bounds write in the IP socket recvmsg() ancillary (cmsg) data handling when building control messages like IP_PKTINFO/IPV6_RECVPKTINFO. The root cause is improper bounds checking: validation considers only the payload length and ignores the aligned cmsghdr header size (NET_CMSG_SPACE vs raw length). An attacker can exploit this by issuing UDP recvmsg() with pktinfo-style options enabled and providing an undersized msg_control buffer; under CONFIG_USERSPACE this is triggerable by an unprivileged userspace thread, and in supervisor mode it can overflow the caller-provided buffer. Impact ranges from kernel heap memory corruption to potential denial of service or code execution depending on heap layout and mitigations. 👉 Affected: zephyr (versions prior to the fix that validates against NET_CMSG_SPACE(pktinfo_len)) | Upgrade to the patched Zephyr release that adds the NET_CMSG_SPACE check and returns -ENOMEM on insufficient msg_control size

    Post summary

    The post discloses a high‑severity out‑of‑bounds write in Zephyr RTOS’s recvmsg handling and provides a patch fix by upgrading to the corrected release.

    00010112
    232 followersView on X
  • Vulmon Vulnerability Feed@VulmonFeeds
    Disclosure

    CVE-2026-10643 Buffer Overflow in Zephyr IP Socket recvmsg() Implementation via Undersized Control Buffer https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-10643

    Post summary

    A buffer overflow vulnerability (CVE-2026-10643) has been disclosed affecting Zephyr's IP Socket recvmsg() due to an undersized control buffer; no PoC, exploit, patch, or active exploitation is reported.

    00010136
    4.1K followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
OSzephyrprojectzephyr---

Explore more

Back to dashboardzephyrproject CVEszephyr vulnerabilities