Zephyr's getaddrinfo() function in the BSD-sockets implementation passes a pointer to a stack-allocated state object as user_data to an asynchronous DNS resolver query. If the semaphore wait times out due to resolver delays or multi-retry configurations, the code retries the query without cancelling the previous one or resetting the semaphore. This leaves the previous query active with a stale pointer to the stack object. Subsequent DNS responses or timeout work invoke a callback using this invalid pointer, causing use-after-return memory corruption. The vulnerability is exploitable by an attacker capable of spoofing or replaying UDP DNS responses, potentially causing crashes or denial of service. The flaw affects Zephyr versions from 4.0.0 up to but not including 4.5.0.

An attacker able to send spoofed or replayed UDP DNS responses can trigger a use-after-return condition, corrupting stack memory. This can lead to application crashes or denial of service. There is no direct confidentiality impact reported. The CVSS 3.1 score is 7.4 (High) with network attack vector, high impact on integrity and availability, and no privileges or user interaction required.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The described fix involves cancelling timed-out queries before retrying and resetting the semaphore to prevent stale callbacks. Until an official patch or update is released, users should monitor the vendor's advisories for updates and consider mitigating exposure to untrusted networks if feasible.