CVE-2026-15891

Received Received - Intake

Null Pointer Dereference in Zephyr MQTT-SN Client

Publication date: 2026-09-13

Last updated on: 2026-09-13

Assigner: Zephyr Project

Description

The MQTT-SN client keepalive handler process_ping() in subsys/net/lib/mqtt_sn/mqtt_sn.c removes the gateway record after PINGREQ retries are exhausted. It invoked SYS_SLIST_PEEK_HEAD_CONTAINER(&client->gateways, gw, next) but discarded the result. That macro is a pure expression that does not assign to gw, so gw retained its NULL initializer regardless of the list contents. The code then dereferences the NULL gw (gw->gw_id) and passes it to mqtt_sn_gw_destroy(), reaching k_mem_slab_free(&gateways, NULL). With CONFIG_MEM_SLAB_POINTER_VALIDATE enabled this triggers k_panic(); in the default configuration it performs a write through the NULL pointer ((char )mem = slab->free_list;) and corrupts the slab free list. The outcome is a crash/kernel panic or, on targets where address 0 is writable, silent memory-allocator corruption. The vulnerable branch runs whenever the connected MQTT-SN gateway fails to answer keepalive PINGREQs for the configured number of retries. This condition is controlled by the remote peer: a malicious or compromised gateway, or an on-path/adjacent attacker that advertises itself as a gateway and then stops responding (or blackholes the real gateway's PINGRESPs), forces the client into the defect. MQTT-SN runs over UDP and no authentication is required. The impact is a remotely triggerable denial of service (availability) of the affected MQTT-SN client; there is no attacker-controlled data written. The sibling remover process_advertise() uses SYS_SLIST_FOR_EACH_CONTAINER_SAFE and is not affected. The fix assigns the macro's return value to gw.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-13

Last Modified

2026-09-13

Generated

2026-09-14

AI Q&A

2026-09-14

EPSS Evaluated

N/A

NVD

CVE-2026-15891

Affected Vendors & Products

Vendor	Product	Version / Range
zephyrproject	mqtt_sn_client	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-476	The product dereferences a pointer that it expects to be valid but is NULL.

Attack-Flow Graph

Executive Summary

This vulnerability is in the MQTT-SN client's keepalive handler where a NULL pointer dereference occurs after PINGREQ retries are exhausted. The code fails to properly assign the gateway record from a macro result, leading to a NULL gw pointer. This causes a crash or kernel panic when CONFIG_MEM_SLAB_POINTER_VALIDATE is enabled, or memory corruption otherwise. The issue arises when a connected gateway stops responding to keepalive requests, triggering the vulnerable code path.

Detection Guidance

This vulnerability is specific to MQTT-SN clients using the Zephyr RTOS library. Detection requires checking if the affected MQTT-SN client is running on your system and if the vulnerable code path is reachable. Monitor for kernel panics or memory corruption errors in logs. No direct commands are provided in the context, but network monitoring for MQTT-SN traffic and gateway responses may help identify abnormal behavior.

Impact Analysis

The vulnerability allows a remote attacker to cause a denial of service by forcing the MQTT-SN client into a crash or kernel panic. This happens if the attacker impersonates a gateway and stops responding to keepalive requests, exhausting retries. The impact is limited to availability; no data is written or leaked by the attacker.

Mitigation Strategies

Apply the vendor fix by updating to a patched version of the MQTT-SN client library. If an update is unavailable, disable the MQTT-SN client or restrict network access to trusted gateways only. Ensure CONFIG_MEM_SLAB_POINTER_VALIDATE is enabled to detect NULL pointer dereferences. Monitor for crashes or memory corruption as indicators of exploitation.

Hi! I’m here to help you understand CVE-2026-15891. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70