Zephyr’s native TCP stack contains a use‑after‑free vulnerability in net_tcp_foreach(). The function iterates the global TCP connection list and temporarily releases tcp_lock while invoking a per‑connection callback. In this window a concurrent tcp_conn_release() can free the next connection in the list, causing the iterator to dereference freed memory. When that occurs the system crashes, leading to a denial of service. If the freed slab is later reallocated, the callback may act on attacker‑controlled data, raising the possibility of information disclosure or additional faults. The flaw, classified as CWE‑416, was introduced with the modern TCP2 stack in 2020 and affects all Zephyr releases through v4.4.0.

The vulnerability is present in Zephyr RTOS versions up to and including 4.4.0, including all releases that use the modern TCP2 stack introduced in 2020. Devices built with zephyrproject:zephyr and exposing the 'net conn' network shell command or that perform net_tcp_close_all_for_iface() on interface‑down are affected.

The CVSS score of 4.8 indicates moderate severity, while an EPSS score of less than 1% suggests a low probability of current exploitation. Attack is likely local or through accepted TCP traffic, requiring a timing window the iteration. Based on the description, that the attacker needs to iteration, which could be facilitated by crafted packets to increase the race condition probability. The flaw is not listed in CISA KEV.