CVE-2026-15891: memory-safety in zephyrproject zephyr
The MQTT-SN client keepalive handler process_ping() in subsys/net/lib/mqtt_sn/mqtt_sn.c removes the gateway record after PINGREQ retries are exhausted. It invoked SYS_SLIST_PEEK_HEAD_CONTAINER(&client->gateways, gw, next) but discarded the result. That macro is a pure expression that does not assign to gw, so gw retained its NULL initializer regardless of the list contents. The code then dereferences the NULL gw (gw->gw_id) and passes it to mqtt_sn_gw_destroy(), reaching k_mem_slab_free(&gateways, NULL). With CONFIG_MEM_SLAB_POINTER_VALIDATE enabled this triggers k_panic(); in the default configuration it performs a write through the NULL pointer ((char )mem = slab->free_list;) and corrupts the slab free list. The outcome is a crash/kernel panic or, on targets where address 0 is writable, silent memory-allocator corruption. The vulnerable branch runs whenever the connected MQTT-SN gateway fails to answer keepalive PINGREQs for the configured number of retries. This condition is controlled by the remote peer: a malicious or compromised gateway, or an on-path/adjacent attacker that advertises itself as a gateway and then stops responding (or blackholes the real gateway's PINGRESPs), forces the client into the defect. MQTT-SN runs over UDP and no authentication is required. The impact is a remotely triggerable denial of service (availability) of the affected MQTT-SN client; there is no attacker-controlled data written. The sibling remover process_advertise() uses SYS_SLIST_FOR_EACH_CONTAINER_SAFE and is not affected. The fix assigns the macro's return value to gw.
AI Analysis
Technical Summary
The MQTT-SN client keepalive handler process_ping() in Zephyr mishandles the gateway record after PINGREQ retries are exhausted by discarding the result of SYS_SLIST_PEEK_HEAD_CONTAINER macro, leaving the gateway pointer null. Subsequent dereferencing of this null pointer leads to either a kernel panic (with CONFIG_MEM_SLAB_POINTER_VALIDATE enabled) or silent memory corruption of the slab free list. This vulnerability is triggered when a connected MQTT-SN gateway fails to respond to keepalive PINGREQs, a condition controllable by a remote attacker who can impersonate or disrupt the gateway. The impact is a remotely triggerable denial of service on the MQTT-SN client. The sibling remover process_advertise() is unaffected. The fix involves assigning the macro's return value to the gateway pointer before use.
Potential Impact
This vulnerability allows a remote attacker to cause a denial of service on the affected MQTT-SN client by triggering a null pointer dereference and subsequent kernel panic or memory corruption. There is no impact on confidentiality or integrity as no attacker-controlled data is written. The denial of service occurs when the MQTT-SN gateway fails to respond to keepalive PINGREQs, which can be forced by a malicious or compromised gateway or an attacker impersonating a gateway. This affects system availability but does not allow code execution or data leakage.
Mitigation Recommendations
A fix is available that correctly assigns the gateway pointer before dereferencing it in the process_ping() handler. Users should upgrade to Zephyr version 4.4.2 or later where this issue is resolved. Until patched, systems may be vulnerable to denial of service if exposed to malicious or compromised MQTT-SN gateways. No additional mitigations are specified or required beyond applying the official fix.
CVE-2026-15891: memory-safety in zephyrproject zephyr
Description
The MQTT-SN client keepalive handler process_ping() in subsys/net/lib/mqtt_sn/mqtt_sn.c removes the gateway record after PINGREQ retries are exhausted. It invoked SYS_SLIST_PEEK_HEAD_CONTAINER(&client->gateways, gw, next) but discarded the result. That macro is a pure expression that does not assign to gw, so gw retained its NULL initializer regardless of the list contents. The code then dereferences the NULL gw (gw->gw_id) and passes it to mqtt_sn_gw_destroy(), reaching k_mem_slab_free(&gateways, NULL). With CONFIG_MEM_SLAB_POINTER_VALIDATE enabled this triggers k_panic(); in the default configuration it performs a write through the NULL pointer ((char )mem = slab->free_list;) and corrupts the slab free list. The outcome is a crash/kernel panic or, on targets where address 0 is writable, silent memory-allocator corruption. The vulnerable branch runs whenever the connected MQTT-SN gateway fails to answer keepalive PINGREQs for the configured number of retries. This condition is controlled by the remote peer: a malicious or compromised gateway, or an on-path/adjacent attacker that advertises itself as a gateway and then stops responding (or blackholes the real gateway's PINGRESPs), forces the client into the defect. MQTT-SN runs over UDP and no authentication is required. The impact is a remotely triggerable denial of service (availability) of the affected MQTT-SN client; there is no attacker-controlled data written. The sibling remover process_advertise() uses SYS_SLIST_FOR_EACH_CONTAINER_SAFE and is not affected. The fix assigns the macro's return value to gw.
CVSS v3.1
Score 7.5high
Affected software
zephyrproject
zephyr
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The MQTT-SN client keepalive handler process_ping() in Zephyr mishandles the gateway record after PINGREQ retries are exhausted by discarding the result of SYS_SLIST_PEEK_HEAD_CONTAINER macro, leaving the gateway pointer null. Subsequent dereferencing of this null pointer leads to either a kernel panic (with CONFIG_MEM_SLAB_POINTER_VALIDATE enabled) or silent memory corruption of the slab free list. This vulnerability is triggered when a connected MQTT-SN gateway fails to respond to keepalive PINGREQs, a condition controllable by a remote attacker who can impersonate or disrupt the gateway. The impact is a remotely triggerable denial of service on the MQTT-SN client. The sibling remover process_advertise() is unaffected. The fix involves assigning the macro's return value to the gateway pointer before use.
Potential Impact
This vulnerability allows a remote attacker to cause a denial of service on the affected MQTT-SN client by triggering a null pointer dereference and subsequent kernel panic or memory corruption. There is no impact on confidentiality or integrity as no attacker-controlled data is written. The denial of service occurs when the MQTT-SN gateway fails to respond to keepalive PINGREQs, which can be forced by a malicious or compromised gateway or an attacker impersonating a gateway. This affects system availability but does not allow code execution or data leakage.
Mitigation Recommendations
A fix is available that correctly assigns the gateway pointer before dereferencing it in the process_ping() handler. Users should upgrade to Zephyr version 4.4.2 or later where this issue is resolved. Until patched, systems may be vulnerable to denial of service if exposed to malicious or compromised MQTT-SN gateways. No additional mitigations are specified or required beyond applying the official fix.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- zephyr
- Date Reserved
- 2026-07-15T17:38:07.683Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6aa72b6955bf5e2cf52e37f8
Added to database: 09/13/2026, 23:02:01 UTC
Last enriched: 09/13/2026, 23:16:29 UTC
Last updated: 09/14/2026, 02:57:48 UTC
Views: 9
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.