CVE-2026-87044

The Mbed TLS crypto shim driver in drivers/crypto/crypto_mbedtls_shim.c drives PSA multipart cipher and AEAD operations. In mbedtls_cbc() and mbedtls_aead(), every error path after a successful psa_cipher_encrypt_setup() / psa_aead_decrypt_setup() returned directly without calling psa_cipher_abort() / psa_aead_abort(). Because the abort is the only thing that reaches mbedtls_cipher_free(), each failed operation permanently leaked the heap-allocated mbedtls_aes_context (roughly 288 bytes) that setup had allocated from Mbed TLS's fixed static heap (_mbedtls_heap[CONFIG_MBEDTLS_HEAP_SIZE], default 512 bytes). With CONFIG_PSA_CRYPTO_PROVIDER_TFM the leaked object is instead a finite secure-partition multipart-operation slot. The failure is chosen by an unauthenticated attacker. With CONFIG_NET_L2_IEEE802154_SECURITY backed by this driver, ieee802154_decrypt_auth() in subsys/net/l2/ieee802154/ieee802154_security.c invokes cipher_ccm_op() on every received secured frame, with no authentication ahead of the MIC check. A device in radio range can transmit a stream of syntactically valid 802.15.4 frames carrying a bogus MIC; each one makes psa_aead_verify() fail and leaks a block. The CBC path is reachable the same way through the OSDP secure channel, where CONFIG_OSDP_SC_ENABLED selects this shim and osdp_encrypt() / osdp_decrypt() leave out_buf_max unset, so every operation fails inside psa_cipher_update(). Exhausting the Mbed TLS heap — which the default configuration reaches after a couple of failed operations, and any realistic configuration reaches in well under a second of frames — makes all subsequent mbedtls_calloc() calls fail. Every later cryptographic operation in the image then fails permanently, including link-layer security and any TLS/DTLS sharing the same heap, until the device is rebooted. There is no memory corruption or information disclosure: frames with an invalid MIC are still rejected, so the impact is limited to availability. The fix routes all post-setup failures in mbedtls_cbc() and mbedtls_aead() through a common error: label that calls the matching PSA abort before returning. Setup failures need no change, since the PSA core aborts the operation itself when setup fails.

• CWE-401

• https://github.com/zephyrproject-rtos/zephyr/commit/8e7e9e9bf9f0b1a7acd12ef3d6d38473b1ce6d43
• https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-r8x3-637f-c986

Published

Nov 4, 2026

Last Modified

Nov 4, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-87038The user-mode verification handler for the i3c_transfer() sy…7
• CVE-2026-87039The user-mode syscall verifier z_vrfy_i2s_configure() in dri…7.8
• CVE-2026-8704Crypt::DSA versions through 1.19 for Perl use 2-args open, a…6.5
• CVE-2026-87040The nRF link-layer receive paths of the open-source Bluetoot…8.3
• CVE-2026-87041The RTIO submission-queue verifier rtio_vrfy_sqe() in subsys…7.8
• CVE-2026-87043The entropy-device random number generator in subsys/random/…4.8
• CVE-2026-87045The HTTP/2 server in subsys/net/lib/http/http_server_http2.c…7.5
• CVE-2026-87046Tanium addressed an improper access controls vulnerability i…4.3
• CVE-2026-87047Tanium addressed an improper access controls vulnerability i…6.3
• CVE-2026-87048Tanium addressed an improper access controls vulnerability i…5.4
• CVE-2026-8705The ClearSale Total plugin for WordPress is vulnerable to SQ…7.5
• CVE-2026-8706Firefox for iOS hosted Reader mode on an unauthenticated loc…6.5