CVE-2026-15891: NULL pointer dereference in Zephyr MQTT-SN client when removing a non-responsive gateway
The MQTT-SN client keepalive handler processping() in subsys/net/lib/mqttsn/mqttsn.c removes the gateway record after PINGREQ retries are exhausted. It invoked SYSSLISTPEEKHEADCONTAINER(&client->gateways, gw, next) but discarded the result. That macro is a pure expression that does not assign to gw, so gw retained its NULL initializer regardless of the list contents.
The code then dereferences the NULL gw (gw->gwid) and passes it to mqttsngwdestroy(), reaching kmemslabfree(&gateways, NULL). With CONFIGMEMSLABPOINTERVALIDATE enabled this triggers kpanic(); in the default configuration it performs a write through the NULL pointer ((char )mem = slab->freelist;) and corrupts the slab free list. The outcome is a crash/kernel panic or, on targets where address 0 is writable, silent memory-allocator corruption.
The vulnerable branch runs whenever the connected MQTT-SN gateway fails to answer keepalive PINGREQs for the configured number of retries. This condition is controlled by the remote peer: a malicious or compromised gateway, or an on-path/adjacent attacker that advertises itself as a gateway and then stops responding (or blackholes the real gateway's PINGRESPs), forces the client into the defect. MQTT-SN runs over UDP and no authentication is required.
The impact is a remotely triggerable denial of service (availability) of the affected MQTT-SN client; there is no attacker-controlled data written. The sibling remover processadvertise() uses SYSSLISTFOREACHCONTAINERSAFE and is not affected. The fix assigns the macro's return value to gw.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Mitigate remotely triggerable DoS by ensuring MQTT-SN gateways are authenticated/authorized at the network level (e.g., only allow traffic from trusted gateway IPs/segments) since the remote peer can force the client into exhausting PINGREQ retries and hitting the defect.
Event History
Frequently Asked Questions
Which deployments are exposed?
Zephyr deployments using the MQTT-SN client are exposed when a connected gateway fails to answer keepalive PINGREQs for the configured retry limit. The affected path is reached during gateway removal after those retries are exhausted.
What does an attacker need to do to trigger the issue?
An attacker can trigger it by operating a malicious or compromised gateway that stops responding to PINGREQs. An on-path or adjacent attacker may also trigger it by advertising itself as a gateway or by blackholing PINGRESPs from the real gateway.
How does the impact differ with memory-slab pointer validation enabled?
With CONFIG_MEM_SLAB_POINTER_VALIDATE enabled, freeing the NULL gateway pointer triggers a kernel panic. In the default configuration, the NULL-pointer write corrupts the memory-slab free list; this may cause a crash or silent allocator corruption on targets where address 0 is writable.