{"id":"CVE-2026-87044","kind":"vulnerability","aliases":["CVE-2026-87044"],"related":[],"title":"Zephyr Mbed TLS shim: failed crypto operations leak heap, causing denial of service","description":"The Mbed TLS crypto shim driver in drivers/crypto/crypto_mbedtls_shim.c drives PSA multipart cipher and AEAD operations. In mbedtls_cbc() and mbedtls_aead(), every error path after a successful psa_cipher_encrypt_setup() / psa_aead_decrypt_setup() returned directly without calling psa_cipher_abort() / psa_aead_abort(). Because the abort is the only thing that reaches mbedtls_cipher_free(), each failed operation permanently leaked the heap-allocated mbedtls_aes_context (roughly 288 bytes) that setup had allocated from Mbed TLS's fixed static heap (_mbedtls_heap[CONFIG_MBEDTLS_HEAP_SIZE], default 512 bytes). With CONFIG_PSA_CRYPTO_PROVIDER_TFM the leaked object is instead a finite secure-partition multipart-operation slot.\n\nThe failure is chosen by an unauthenticated attacker. With CONFIG_NET_L2_IEEE802154_SECURITY backed by this driver, ieee802154_decrypt_auth() in subsys/net/l2/ieee802154/ieee802154_security.c invokes cipher_ccm_op() on every received secured frame, with no authentication ahead of the MIC check. A device in radio range can transmit a stream of syntactically valid 802.15.4 frames carrying a bogus MIC; each one makes psa_aead_verify() fail and leaks a block. The CBC path is reachable the same way through the OSDP secure channel, where CONFIG_OSDP_SC_ENABLED selects this shim and osdp_encrypt() / osdp_decrypt() leave out_buf_max unset, so every operation fails inside psa_cipher_update().\n\nExhausting the Mbed TLS heap — which the default configuration reaches after a couple of failed operations, and any realistic configuration reaches in well under a second of frames — makes all subsequent mbedtls_calloc() calls fail. Every later cryptographic operation in the image then fails permanently, including link-layer security and any TLS/DTLS sharing the same heap, until the device is rebooted. There is no memory corruption or information disclosure: frames with an invalid MIC are still rejected, so the impact is limited to availability.\n\nThe fix routes all post-setup failures in mbedtls_cbc() and mbedtls_aead() through a common error: label that calls the matching PSA abort before returning. Setup failures need no change, since the PSA core aborts the operation itself when setup fails.","summary":"The Mbed TLS crypto shim driver in Zephyr does not release its cipher context when a CBC or AEAD operation fails after setup. An unauthenticated device in radio range can send forged 802.15.4 frames to exhaust the heap, after which all later cryptographic operations fail until reboot.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["embedded","ieee802154","mbedtls","osdp","runtime","zephyr"],"not_affected_if":["default-config","no-ieee802154-security","no-osdp-secure-channel"],"how_to_check":"- Check whether the image enables `CONFIG_NET_L2_IEEE802154_SECURITY` or `CONFIG_OSDP_SC_ENABLED` with this Mbed TLS crypto shim driver selected.\n- Check whether the image uses `CONFIG_PSA_CRYPTO_PROVIDER_TFM`.\n- Check the Zephyr version in use against the fix link.","fix":null,"status":"open","published_at":"2026-11-04T06:17:07+00:00","first_seen_at":"2026-11-04T06:25:20+00:00","triaged_at":"2026-11-04T06:26:01+00:00","updated_at":"2026-11-04T06:26:01+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-11-04T06:26:01Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Zephyr Mbed TLS shim: failed crypto operations leak heap, causing denial of service","impact":"low","summary":"The Mbed TLS crypto shim driver in Zephyr does not release its cipher context when a CBC or AEAD operation fails after setup. An unauthenticated device in radio range can send forged 802.15.4 frames to exhaust the heap, after which all later cryptographic operations fail until reboot.","audience":"developers","category":"runtime","nicknames":[],"who_cares":["zephyr","embedded","ieee802154","osdp","mbedtls"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"Crypto operations fail permanently until the device is rebooted.","analyst_note":"Confirm the fixed Zephyr version and the patch scope from the linked patch and vendor advisory pages.","how_to_check":"- Check whether the image enables `CONFIG_NET_L2_IEEE802154_SECURITY` or `CONFIG_OSDP_SC_ENABLED` with this Mbed TLS crypto shim driver selected.\n- Check whether the image uses `CONFIG_PSA_CRYPTO_PROVIDER_TFM`.\n- Check the Zephyr version in use against the fix link.","plain_action":"","needs_analyst":true,"not_affected_if":["default-config","no-ieee802154-security","no-osdp-secure-channel"],"who_is_affected":"Only builds of Zephyr-based firmware that use the Mbed TLS crypto shim driver together with IEEE 802.15.4 link-layer security or the OSDP secure channel. The sources do not name specific fixed versions. Systems that do not enable these options are not exposed.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000819,"input_tokens":4942,"output_tokens":649,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':15A,18A '-87044':16A,19A '288':143C '512':163C '802.15.4':58B,237C 'abort':114C,117C,120C,402C,414C 'ae':140C 'aead':44B,86C,93C,105C,116C,247C,391C 'ahead':220C 'alloc':138C,148C 'attack':192C 'auth':205C 'authent':219C 'avail':377C 'back':199C 'block':253C 'bogus':241C 'buf':282C 'byte':144C,164C 'call':111C,326C,398C 'calloc':325C 'carri':239C 'caus':10A 'cbc':42B,90C,255C,388C 'ccm':210C 'chang':409C 'channel':266C 'check':224C 'chosen':188C 'cipher':38B,84C,101C,113C,128C,209C,291C 'common':394C 'config':158C,166C,194C,268C 'configur':301C,312C 'context':39B,141C 'core':413C 'corrupt':359C 'coupl':305C 'crypto':6A,29B,76C,168C 'cryptograph':68B,330C 'cve':14A,17A 'decrypt':106C,204C,279C 'default':162C,300C 'denial':11A 'devic':51B,226C,352C 'direct':109C 'disclosur':362C 'drive':81C 'driver':31B,78C,202C 'drivers/crypto/crypto_mbedtls_shim.c':80C 'embed':20B 'enabl':271C 'encrypt':102C,277C 'error':95C,395C 'everi':94C,213C,286C,328C 'exhaust':61B,293C 'fail':5A,46B,70B,131C,249C,288C,307C,327C,336C,420C 'failur':186C,385C,406C 'finit':177C 'fix':153C,379C 'forg':57B 'frame':59B,216C,238C,320C,363C 'free':129C 'heap':9A,63B,137C,155C,157C,160C,297C,349C 'heap-alloc':136C 'ieee802154':21B,197C,203C 'imag':334C 'impact':373C 'includ':338C 'inform':361C 'insid':289C 'instead':175C 'invalid':366C 'invok':208C 'l2':196C 'label':396C 'later':67B,329C 'layer':341C 'leak':8A,134C,172C,251C 'leav':280C 'limit':375C 'link':340C 'link-lay':339C 'make':245C,321C 'match':400C 'max':283C 'mbed':2A,27B,74C,150C,295C 'mbedtl':22B,89C,92C,127C,139C,156C,159C,324C,387C,390C 'memori':358C 'mic':223C,242C,367C 'multipart':83C,182C 'multipart-oper':181C 'need':407C 'net':195C 'object':173C 'one':244C 'op':211C 'oper':7A,45B,69B,87C,132C,183C,287C,308C,331C,416C 'osdp':23B,264C,269C,276C,278C 'partit':180C 'path':96C,256C 'perman':133C,337C 'post':383C 'post-setup':382C 'provid':169C 'psa':82C,100C,104C,112C,115C,167C,246C,290C,401C,412C 'radio':53B,228C 'rang':54B,229C 'reach':126C,302C,313C 'reachabl':258C 'realist':311C 'reboot':72B,354C 'receiv':214C 'reject':370C 'releas':36B 'return':108C,404C 'rough':142C 'rout':380C 'runtim':24B 'sc':270C 'second':318C 'secur':179C,198C,215C,265C,342C 'secure-partit':178C 'select':272C 'send':56B 'servic':13A 'setup':48B,103C,107C,146C,384C,405C,419C 'share':346C 'shim':4A,30B,77C,274C 'sinc':410C 'size':161C 'slot':184C 'static':154C 'still':369C 'stream':233C 'subsequ':323C 'subsys/net/l2/ieee802154/ieee802154_security.c':207C 'success':99C 'syntact':235C 'tfm':170C 'thing':124C 'tls':3A,28B,75C,151C,296C 'tls/dtls':345C 'transmit':231C 'unauthent':50B,191C 'unset':284C 'updat':292C 'valid':236C 'verifi':248C 'way':261C 'well':315C 'without':110C 'zephyr':1A,25B,33B","nicknames":[],"mitigations":[],"who_affected":"Only builds of Zephyr-based firmware that use the Mbed TLS crypto shim driver together with IEEE 802.15.4 link-layer security or the OSDP secure channel. The sources do not name specific fixed versions. Systems that do not enable these options are not exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["embedded","ieee802154","mbedtls","medium","osdp","runtime","zephyr"],"campaign_type":null,"first_public_at":"2026-11-03T14:53:12+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"vulnerabilities@zephyrproject.org","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-87044","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87044","severity":null,"published_at":"2026-11-04T06:17:07+00:00","modified_at":"2026-11-04T06:17:07+00:00","first_seen_at":"2026-11-04T06:25:20+00:00","fetched_at":"2026-11-04T06:25:20+00:00","note":null}],"documents":[{"id":64664,"url":"https://github.com/zephyrproject-rtos/zephyr/commit/8e7e9e9bf9f0b1a7acd12ef3d6d38473b1ce6d43","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":64665,"url":"https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-r8x3-637f-c986","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-11-03T14:53:12+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}