Zephyr’s native TCP stack contains a use‑after‑free vulnerability in the net_tcp_foreach() routine. During iteration the function temporarily releases the tcp_lock while invoking a per‑connection callback. In that brief window a concurrent tcp_conn_release() can free the next connection in the global list, causing the iterator to dereference freed or reallocated memory. This can crash the device, resulting in a denial of service. If memory is subsequently reused, the callback may operate on attacker‑controlled data, potentially leaking information or triggering further faults. The bug is presented when the net conn network shell command is used or when net_tcp_close_all_for_iface() is executed on an interface down, which are legitimate production actions. The flaw was introduced with the modern TCP2 stack in 2020 and affects Zephyr releases up to and including v4.4.0.

The vulnerability is present in Zephyr RTOS versions up to and including 4.4.0, including all releases that use the modern TCP2 stack introduced in 2020. Devices built with zephyrproject:zephyr and exposing the 'net conn' network shell command or that perform net_tcp_close_all_for_iface() on interface‑down are affected.

The CVSS score of 4.8 indicates moderate severity, while an EPSS score of less than 1% suggests a low probability of current exploitation. Attack is likely local or through accepted TCP traffic, requiring a timing window the iteration. Based on the description, that the attacker needs to iteration, which could be facilitated by crafted packets to increase the race condition probability. The flaw is not listed in CISA KEV.