CVE-2026-8718 in Zephyr
Summary
by MITRE • 08/11/2026
tls_opt_dtls_peer_connection_id_value_get() in subsys/net/lib/sockets/sockets_tls.c, which handles getsockopt(SOL_TLS, TLS_DTLS_PEER_CID_VALUE), passed the caller-supplied optval directly to mbedtls_ssl_get_peer_cid() without verifying the buffer was at least MBEDTLS_SSL_CID_OUT_LEN_MAX (default 32) bytes. mbedtls_ssl_get_peer_cid() copies the peer-negotiated DTLS Connection ID (length 1..MBEDTLS_SSL_CID_OUT_LEN_MAX) into that buffer without a destination-size parameter, so a caller-supplied optlen smaller than the CID causes a write of up to 31 bytes past the buffer end.
In CONFIG_USERSPACE builds the getsockopt syscall verifier (z_vrfy_zsock_getsockopt) bounce-buffers the user's optval into a kernel allocation of exactly optlen bytes (k_usermode_alloc_from_copy -> z_thread_malloc), so an unprivileged user thread that passes a small optlen on a connected DTLS socket with Connection ID enabled induces a kernel-heap buffer overflow, with the overflowing content being the remote peer's CID.
The defect requires CONFIG_MBEDTLS_SSL_DTLS_CONNECTION_ID, an established DTLS session with a negotiated peer CID, and (for the kernel-crossing case) CONFIG_USERSPACE. Introduced when the TLS_DTLS_CID option was added (v3.5.0).
The fix rejects callers whose optlen is below MBEDTLS_SSL_CID_OUT_LEN_MAX with -EINVAL.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/11/2026
This vulnerability exists in the Zephyr RTOS network stack implementation where the tls_opt_dtls_peer_connection_id_value_get() function fails to validate buffer size before passing user-provided socket options to the underlying mbedtls library. The function handles the TLS_DTLS_PEER_CID_VALUE option by directly forwarding the caller-supplied optval parameter to mbedtls_ssl_get_peer_cid() without first verifying that the buffer is sufficiently large to accommodate the maximum possible DTLS Connection ID length of 32 bytes. This design flaw creates a classic buffer overflow condition where the mbedtls library performs a memcpy operation without bounds checking, writing up to 31 bytes beyond the allocated buffer boundary when the actual CID length is smaller than the provided buffer size.
The security implications become particularly severe in CONFIG_USERSPACE enabled builds where the system call verifier implements a bounce buffering mechanism that allocates kernel memory exactly matching the user-provided optlen parameter. When an unprivileged user thread invokes getsockopt with a deliberately small optlen value on a connected DTLS socket that has negotiated a peer Connection ID, the kernel heap becomes vulnerable to overflow. The overflowing data originates from the remote peer's CID information, potentially allowing for kernel memory corruption that could be exploited to escalate privileges or cause system instability. This vulnerability affects systems running Zephyr versions 3.5.0 and later where the TLS_DTLS_CID option was introduced.
The vulnerability maps directly to CWE-121 and CWE-787 which describe buffer overflow conditions in stack and heap memory respectively, with the specific ATT&CK technique of T1068 (Exploitation for Privilege Escalation) being applicable. The attack requires three specific configuration conditions to be present: CONFIG_MBEDTLS_SSL_DTLS_CONNECTION_ID must be enabled, there must be an established DTLS session with a negotiated peer CID, and CONFIG_USERSPACE must be active for the kernel crossing scenario to occur. This combination creates a path where user-space memory can be manipulated to cause kernel heap corruption through the socket option interface.
The fix implements proper validation by rejecting any getsockopt calls that provide an optlen parameter smaller than MBEDTLS_SSL_CID_OUT_LEN_MAX (32 bytes) with an -EINVAL error code, effectively preventing the buffer overflow condition before it can occur. This mitigation aligns with secure coding practices that emphasize input validation and bounds checking to prevent memory corruption vulnerabilities in system-level APIs. The solution maintains backward compatibility for legitimate callers while eliminating the attack surface created by the unchecked buffer size parameter.