CVE-2026-10646: Use-after-return in `zsock_getaddrinfo()` when a timed-out DNS query is retried without cancellation
Zephyr's BSD-sockets getaddrinfo() implementation (subsys/net/lib/sockets/getaddrinfo.c) passes a pointer to a stack-allocated state object (struct getaddrinfostate aistate) as the userdata of an asynchronous DNS resolver query. The socket layer waits on a semaphore with a timeout deliberately set slightly longer than the resolver's own per-query timeout. When that semaphore wait nonetheless times out (-EAGAIN) - which can occur when the resolver's timeout work is delayed by workqueue contention, or in the documented multi-retry configuration where CONFIGNETSOCKETSDNSTIMEOUT exceeds CONFIGNETSOCKETSDNSBACKOFFINTERVAL - the pre-fix code retries the query (goto again) without cancelling the previous one and without resetting the semaphore.
The previous query slot remains active in the resolver with its callback and the stack pointer as userdata, and aistate->dnsid is overwritten so the stale query can no longer be cancelled. A subsequent DNS response delivered over UDP and matched by its 16-bit transaction id (in dispatchercb()/dnsread()), or the resolver's own delayed query-timeout work, then invokes dnsresolvecb() against the now out-of-scope stack frame, writing through the stale pointer (state->status, state->idx, state->aiarr[], and ksemgive()).
Because the triggering response is network-delivered and its 16-bit id is spoofable/replayable by an on- or off-path attacker, this is a network-influenceable use-after-return that can corrupt reused stack memory, leading to crashes/denial of service or memory corruption.
The fix cancels the timed-out query by name and type before retrying and resets the local semaphore, eliminating the stale callback path. Affected: Zephyr v4.0.0 through v4.4.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Ensure CONFIG_NET_SOCKETS_DNS_TIMEOUT is not greater than CONFIG_NET_SOCKETS_DNS_BACKOFF_INTERVAL to avoid the documented pre-fix retry path that re-issues DNS queries without cancelling the previous one when the semaphore wait times out (-EAGAIN).
Zephyr BSD-sockets getaddrinfo() DNS retry logic (subsys/net/lib/sockets/getaddrinfo.c) CONFIG_NET_SOCKETS_DNS_TIMEOUT vs CONFIG_NET_SOCKETS_DNS_BACKOFF_INTERVAL = Set CONFIG_NET_SOCKETS_DNS_TIMEOUT to not exceed CONFIG_NET_SOCKETS_DNS_BACKOFF_INTERVAL (so the semaphore wait does not time out with -EAGAIN and trigger a retry without cancellation) - Operational
After applying the fix, restart affected applications/services using Zephyr zsock_getaddrinfo() so the updated DNS cancellation/reset logic is used for any in-flight or newly triggered timed-out DNS retries.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-10646?
CVE-2026-10646 has a severity rating of high with a score of 7.4.
What type of vulnerability is identified in CVE-2026-10646?
CVE-2026-10646 is classified as a Use After Free vulnerability.
How do I fix CVE-2026-10646?
To mitigate CVE-2026-10646, update to the patched version of the Zephyr software where the issue has been addressed.
What component of Zephyr is affected by CVE-2026-10646?
CVE-2026-10646 affects the BSD-sockets getaddrinfo() implementation within the Zephyr networking subsystem.
What causes the vulnerability in CVE-2026-10646?
The vulnerability occurs due to a use-after-return condition when a DNS query timeout occurs and the state object is accessed after it has gone out of scope.