This vulnerability in Zephyr RTOS arises from a race condition during TCP connection teardown. Specifically, if tcp_conn_search() returns NULL while processing a SYN packet, tcp_recv() uses a stale NULL pointer without validation, which is then dereferenced in tcp_backlog_is_full(), resulting in a crash. The CVSS 3.1 base score is 6.4, reflecting network attack vector, high attack complexity, low privileges required, no user interaction, unchanged scope, low confidentiality and integrity impact, but high availability impact due to the crash.

Successful exploitation causes a NULL pointer dereference leading to a crash of the affected system, impacting availability. Confidentiality and integrity impacts are low. There are no known exploits in the wild. The vulnerability affects all versions of Zephyr as indicated, but no further geographic or product-specific targeting is noted.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should monitor vendor communications for updates. No vendor advisory or patch links are currently provided, so no specific mitigation steps can be recommended beyond awaiting an official fix.