{"id":"CVE-2026-15924","summary":"Use-after-free / double-free from unsynchronized concurrent access to the TLS client session cache in Zephyr sockets","details":"Zephyr's TLS socket layer in subsys/net/lib/sockets/sockets_tls.c keeps a single process-global array, client_cache, of cached client sessions that is shared by every TLS socket context. The functions that mutate and read it — tls_session_save(), tls_session_get(), tls_session_cache_reset(), and the settings restore handler — allocate, free, and dereference each entry's heap buffer (entry-\u003esession). Before the fix these accesses were serialized only by the per-socket context mutex ctx-\u003elock (assigned per socket in ctx_set_lock()), which provides no mutual exclusion between different sockets touching the shared cache.\n\nBecause CONFIG_NET_SOCKETS_TLS_MAX_CLIENT_SESSION_COUNT defaults to 1, any two concurrent client sockets contend for the same slot. A thread in tls_session_get() reading entry-\u003esession inside mbedtls_ssl_session_load() can run concurrently with another thread in tls_session_save() that selects the same entry for reuse and executes mbedtls_free(entry-\u003esession) before reallocating — a use-after-free read, and a double-free when two saves evict the same entry. Both corrupt the mbedTLS heap. The cache is reached on ordinary client paths: at connect time via tls_session_store()/tls_session_restore(), and (on main) whenever a TLS 1.3 session ticket arrives during recv()/poll() via tls_session_store_current().\n\nExploitation requires an application that opts into per-socket client session caching (the TLS_SESSION_CACHE socket option, off by default) and runs concurrent TLS client connections on multiple threads; the timing that opens the window is influenced by the remote peer(s), so a malicious or compromised server can raise session-ticket frequency to widen it. The reliably-demonstrable impact is memory corruption leading to a crash or heap corruption (denial of service). The fix adds a dedicated session_cache_lock mutex taken across every accessor of client_cache, serializing all reads and frees and closing the race.","aliases":["GHSA-wcgm-pq6x-v2gf"],"modified":"2026-09-16T08:29:35.121428Z","published":"2026-09-14T19:33:45.222Z","database_specific":{"cna_assigner":"zephyr","cwe_ids":["CWE-416"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/15xxx/CVE-2026-15924.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/15xxx/CVE-2026-15924.json"},{"type":"ADVISORY","url":"https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-wcgm-pq6x-v2gf"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-15924"},{"type":"FIX","url":"https://github.com/zephyrproject-rtos/zephyr/commit/7f9d8ee32ba9a93fc1dbb192ca2a591ac0853bdc"},{"type":"PACKAGE","url":"https://github.com/zephyrproject-rtos/zephyr"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/zephyrproject-rtos/zephyr","events":[{"introduced":"2ddd73feafd3316af2c547c34d6969bea637d5c6"},{"fixed":"7f9d8ee32ba9a93fc1dbb192ca2a591ac0853bdc"}],"database_specific":{"extracted_events":[{"introduced":"3.1.0"},{"fixed":"4.4.2"}],"source":["AFFECTED_FIELD","REFERENCES"]}}],"versions":["v4.4.0","v4.4.0-rc3","v4.4.0-rc2","v4.4.0-rc1","v4.3.0","v4.3.0-rc3","v4.3.0-rc2","v4.3.0-rc1","v4.2.0","v4.2.0-rc3","v4.2.0-rc2","v4.2.0-rc1","v4.1.0","v4.1.0-rc3","v4.1.0-rc2","v4.1.0-rc1","v4.0.0","v4.0.0-rc3","v4.0.0-rc2","v4.0.0-rc1","v3.7.0","v3.7.0-rc3","v3.7.0-rc2","v3.7.0-rc1","v3.6.0","v3.6.0-rc3","v3.6.0-rc2","v3.6.0-rc1","zephyr-v3.5.0","v3.5.0","v3.5.0-rc3","v3.5.0-rc2","v3.5.0-rc1","zephyr-v3.4.0","v3.4.0","v3.4.0-rc3","v3.4.0-rc2","v3.4.0-rc1","zephyr-v3.3.0","v3.3.0","v3.3.0-rc3","v3.3.0-rc2","v3.3.0-rc1","zephyr-v3.2.0","v3.2.0","v3.2.0-rc3","v3.2.0-rc2","v3.2.0-rc1","zephyr-v3.1.0","v3.1.0"],"database_specific":{"vanir_signatures_modified":"2026-09-16T08:29:35Z","vanir_signatures":[{"target":{"file":"subsys/net/lib/sockets/sockets_tls.c","function":"tls_session_cache_reset"},"deprecated":false,"digest":{"length":268,"function_hash":"84076503673132904141263879048588968409"},"id":"CVE-2026-15924-4b86447a","signature_type":"Function","signature_version":"v1","source":"https://github.com/zephyrproject-rtos/zephyr/commit/7f9d8ee32ba9a93fc1dbb192ca2a591ac0853bdc"},{"digest":{"function_hash":"201406064147848106915555039872883681264","length":1210},"id":"CVE-2026-15924-53402769","signature_type":"Function","signature_version":"v1","source":"https://github.com/zephyrproject-rtos/zephyr/commit/7f9d8ee32ba9a93fc1dbb192ca2a591ac0853bdc","target":{"file":"subsys/net/lib/sockets/sockets_tls.c","function":"tls_session_cache_settings_set"},"deprecated":false},{"id":"CVE-2026-15924-6c9e8bed","signature_type":"Line","signature_version":"v1","source":"https://github.com/zephyrproject-rtos/zephyr/commit/7f9d8ee32ba9a93fc1dbb192ca2a591ac0853bdc","target":{"file":"subsys/net/lib/sockets/sockets_tls.c"},"deprecated":false,"digest":{"line_hashes":["145714100487138061576657184657309090498","62580723398833153143452562272082478912","332939560407895060105890456812682010130","199602280941156675710256089388890393346","114459422250821868164400832398122960497","31340520617935540883440767263036900167","43063730323709261002551305858281728497","301383632932240578853305007505149360620","91163646166306232384269796500807707382","302730253905558391526285520947570010370","90388764129299465477079520699021125707","176118217375137089943066269527225077359","280927832207701714584639055571533665687","71375762766798064896835323100319553567","213785451428253995381116024211750543794","196071985676753059500165616649561959242","35137369956682148237614125693909989672","153653758822270457578660630621626543039","179624416511084041984267343800720065994","81866648921522440542120969231706707123","43930327957758679415874712418383816599","313528386589611146665554900553938805306","49712149386114833018735637741882858042","151283791327528816898907513477041299587","249144780485986174051521908971830759959","296952165173771992712585670235462823456","170239761794953073178753756827989744776","320274288923332347708315305366139604473","425256266874141211362313466229675157","67947222632328565541991166796053424189","53077791541773218933844118521789765651","119801705250830911890683466671057997874","1584446233370852472196192268172063058","272770982209385561943549677340675114199","200970506084229117032904947150905156960","36470715159955325718841117268227002616","26931372703168500815694986267020133058","175309926310652562995302257484236816114","316325400781193306417515239160897289861","130792064144651751152617933231792648861","256931234936778836312623579985271061056","254885714533638183453037424065321589632","20876143595759419181033644362876483773","145792379319390159584657223830236298907","326638803312684595041629695835201062935","316295405501817236814878198707255112693","61759151501417486904366718914854903313","152816393006465133603965952394418525545","32251927845796242613049555711052830719","300085509605217701269836585501839299683","274017481954861006601230022213625430564","15966590562585794418137467187256164305","242299890830378680909689838888206037876","129825842519581594170568226340920616116","252191006116875071775745768303029238360","49390295369484556483758249185696295024","300224996220380546076727173830483064216","147012772364709519519777052940122606703","85167844315930382736606091076340230471","284895670379811693735864102721713928256","8442631838651106952104255735457054522","76344666524373614246412722530788769435","261537018777599863378332214265798641150","257069540004015075617086053311605769066","175092987475208270529396137139230940660","150923495869570028367908773332357919100","254537464804417944353567358071367363153","150542741938066830386324376355364699818","17038508577048407006413434684871742260","104646527592843862511000755154891766067","215438852887920263842119435499529738719"],"threshold":0.9}},{"deprecated":false,"digest":{"length":1274,"function_hash":"97860790787190789619820524674758005848"},"id":"CVE-2026-15924-b0dad983","signature_type":"Function","signature_version":"v1","source":"https://github.com/zephyrproject-rtos/zephyr/commit/7f9d8ee32ba9a93fc1dbb192ca2a591ac0853bdc","target":{"file":"subsys/net/lib/sockets/sockets_tls.c","function":"tls_session_save"}},{"id":"CVE-2026-15924-d21585c8","signature_type":"Function","signature_version":"v1","source":"https://github.com/zephyrproject-rtos/zephyr/commit/7f9d8ee32ba9a93fc1dbb192ca2a591ac0853bdc","target":{"file":"subsys/net/lib/sockets/sockets_tls.c","function":"tls_session_get"},"deprecated":false,"digest":{"length":574,"function_hash":"159073813060476223658901981520963074318"}}],"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-15924.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"}]}