CVE-2026-5590

/* * PoC Concept for CVE-2026-5590 * Demonstrating the NULL pointer dereference trigger. */ #include <stdio.h> // Mock function representing the vulnerable logic int tcp_backlog_is_full(void *conn) { // Vulnerability: Dereferencing conn without checking for NULL // Accessing a member of the connection structure return ((struct tcp_conn *)conn)->backlog >= 10; } void trigger_crash() { // Simulate tcp_conn_search() returning NULL due to race condition struct tcp_conn *conn = NULL; // The vulnerable code path passes the NULL pointer directly if (tcp_backlog_is_full(conn)) { printf("Backlog full\n"); } } int main() { trigger_crash(); return 0; }

{"cve": {"id": "CVE-2026-5590", "sourceIdentifier": "[email protected]", "published": "2026-04-05T04:16:16.370", "lastModified": "2026-04-07T13:20:35.010", "vulnStatus": "Awaiting Analysis", "cveTags": [], "descriptions": [{"lang": "en", "value": "A race condition during TCP connection teardown can cause tcp_recv() to operate on a connection that has already been released. If tcp_conn_search() returns NULL while processing a SYN packet, a NULL pointer derived from stale context data is passed to tcp_backlog_is_full() and dereferenced without validation, leading to a crash."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H", "baseScore": 6.4, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "HIGH"}, "exploitabilityScore": 1.6, "impactScore": 4.7}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-476"}]}], "references": [{"url": "https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-4vqm-pw24-g9jp", "source": "[email protected]"}]}}