CVE-2026-18417 | CVSS: 6.5 | 严重级别: MEDIUM
The native BSD-socket layer recorded a pending asynchronous socket error by type-punning it into struct net_context's void user_data field (ctx->user_data = INT_TO_POINTER(-status) in zsock_accepted_cb(), zsock_received_cb(), zsock_connected_cb() and zsock_close_ctx() in subsys/net/lib/sockets/sockets_inet.c), reading it back with POINTER_TO_INT(). That same field is owned by the network stack for listening TCP contexts: net_tcp_accept() stores the parent context pointer there and the TCP core passes it back to the registered accept callback. A failed accept therefore left a small integer (an
参考链接:
• https://github.com/zephyrproject-rtos/zephyr/commit/ef370a57d07637aaee8cec7b0bce
• https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-p8r8-8mw8-
📌 数据来源: NVD 官方