A race condition during TCP connection teardown can cause tcp_recv() to operate on a connection that has already been released.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

1. Apr 5, 2026 · NIST NVD

   Detected

   A race condition during TCP connection teardown can cause tcp_recv() to operate on a connection that has already been released. If tcp_conn_search() returns NULL while processing a SYN packet, a NULL pointer derived from stale context data is passed to tcp_backlog_is_full() and dereferenced without validation, leading to a crash.

2. Jul 24, 2026 · NIST NVD

   Updated

   A race condition during TCP connection teardown can cause tcp_recv() to operate on a connection that has already been released. If tcp_conn_search() returns NULL while processing a SYN packet, a NULL pointer derived from stale context data is passed to tcp_backlog_is_full() and dereferenced without validation, leading to a crash.

3. Oct 15, 2026 · NIST NVD

   Updated

   A race condition during TCP connection teardown can cause tcp_recv() to operate on a connection that has already been released. If tcp_conn_search() returns NULL while processing a SYN packet, a NULL pointer derived from stale context data is passed to tcp_backlog_is_full() and dereferenced without validation, leading to a crash.

Affected

• cpe zephyrproject/zephyrversion unspecified

Sources

• CVE.orgVulnerability recordCVE-2026-5590

  Official CVE identifier

  cve.org
• NIST NVDVulnerability recordCVE-2026-5590

  A race condition during TCP connection teardown can cause tcp_recv() to operate on a connection that has already been released. If tcp_conn_search() returns NULL while processing a SYN packet, a NULL pointer derived from stale context data is passed to tcp_backlog_is_full() and d

  nvd.nist.gov

References

• Exploit · github.com