The vulnerability involves the native BSD-socket layer in Zephyr where asynchronous socket errors are type-punned into the void user_data field of struct net_context, which is also used by the network stack to store a pointer to the parent context for listening TCP sockets. When a network interface carrying a listening TCP socket goes down, the accept callback is invoked with an error code stored in user_data, which is then dereferenced as a pointer, causing wild-pointer access and a kernel fatal error. This flaw affects Zephyr versions >=4.3.0 and <4.4.2. The root cause is that the error code (an errno value) overwrites a pointer field, leading to invalid memory accesses on repeated interface-down events. The fix introduced a dedicated sock_error field for storing errors and updated all producers and consumers to use sock_set_error()/sock_get_error(), preventing user_data corruption and eliminating the crash path.

The vulnerability leads to a denial of service condition by causing a kernel fatal error (device crash or reset) when a listening TCP socket remains open across repeated network interface down events. There is no direct confidentiality or integrity impact, and no attacker-controlled memory corruption is possible. The practical attacker is one capable of forcing repeated link-down events, such as an adjacent attacker disrupting wireless connectivity or an attacker with local or physical access to the device.

A fix is available and included in Zephyr versions 4.4.2 and later. The fix separates error storage from the user_data field and updates all related code paths to use dedicated error handling functions. Users should upgrade to version 4.4.2 or later to remediate this issue. No additional mitigation is required once the fix is applied.