CVE-2026-5590Medium· 6.4▾ SunlitA race condition during TCP connection teardown can cause tcp_recv() to operate on a connection that has already been released. If tcp_conn_search() returns NULL while processing a SYN packet, a NULL pointer derived from stale context da…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 35.2 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Jul 31.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.2%
0.2% → 0.3%
Last analysed / modified upstream
A race condition during TCP connection teardown can cause tcp_recv() to operate on a connection that has already been released. If tcp_conn_search() returns NULL while processing a SYN packet, a NULL pointer derived from stale context data is passed to tcp_backlog_is_full() and dereferenced without validation, leading to a crash.
zephyr <= 4.3.0Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-82389Medium· 6.5Bluetooth Classic HFP AG wipes an object still linked in the SDP request list on connect failure, causing a NULL dereference
CVE-2026-79976High· 7.1NULL pointer dereference in the MCTP I2C+GPIO target binding triggerable by a peer I2C controller
CVE-2026-76787Medium· 5.9NULL pointer dereference in the UpdateHub FOTA client when probe metadata omits sha256sum
CVE-2026-10678High· 8.1NULL-pointer / out-of-bounds write in Zephyr MCTP I2C+GPIO target binding driven by an unauthenticated I2C controller
CVE-2026-10670Medium· 5.5User-triggerable kernel NULL-pointer dereference (DoS) in `k_thread_name_copy()` syscall verifier
CVE-2026-10648Medium· 6.2NULL-pointer dereference in MCUmgr serial/console SMP transport on buffer-pool exhaustion