GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-15923 (GCVE-0-2026-15923)

Vulnerability from cvelistv5 – Published: 2026-09-14 16:12 – Updated: 2026-09-14 19:40
VLAI
Title
Infinite loop denial of service in Zephyr SDIO byte-I/O from a card-supplied zero max_blk_size
Summary
The Zephyr SDIO subsystem function sdio_io_rw_extended_helper() in subsys/sd/sdio.c finishes transfers with a byte-I/O loop that uses size = MIN(remaining, func->cis.max_blk_size) as the per-iteration step. The value func->cis.max_blk_size is decoded directly from the SDIO card's CIS FUNCE tuple in sdio_decode_cis() and is not validated. When a card reports a maximum block size of zero, size is always 0, remaining never decreases, and the loop spins forever. The loop is reached from the public SDIO client API used by drivers, including sdio_read_fifo(), sdio_write_fifo(), and the incrementing register read/write helpers, each of which enters the loop while holding the per-card mutex func->card->lock. A card advertising max_blk_size == 0 therefore hangs the calling thread permanently on its first non-block-aligned transfer and never releases the mutex, denying service to the SDIO peripheral (and any subsystem such as Wi-Fi that depends on it) until the device is reset. The malicious value must come from the SDIO card itself, so the defect is exploitable where a removable SDIO/combo card slot lets an attacker insert a crafted or malfunctioning card (a physical attack vector); on boards with a soldered SDIO peripheral it is not attacker-influenceable. There is no memory-safety, confidentiality, or integrity impact — only a permanent availability loss. The fix returns -EIO when func->cis.max_blk_size is zero, before the loop is entered.
Severity
4.6 (Medium)
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-14 19:39 UTC
CWE
Assigner
References
Impacted products
Vendor Product Version CPE status
zephyrproject zephyr Affected: 3.6.0 , < 4.4.2 (semver)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-15923",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-14T19:39:59.149731Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-14T19:40:10.205Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://github.com/zephyrproject-rtos/zephyr",
          "defaultStatus": "unaffected",
          "packageName": "zephyr",
          "product": "zephyr",
          "programFiles": [
            "subsys/sd/sdio.c"
          ],
          "programRoutines": [
            {
              "name": "sdio_io_rw_extended_helper"
            },
            {
              "name": "sdio_read_addr"
            },
            {
              "name": "sdio_read_fifo"
            },
            {
              "name": "sdio_write_addr"
            },
            {
              "name": "sdio_write_fifo"
            }
          ],
          "vendor": "zephyrproject",
          "versions": [
            {
              "lessThan": "4.4.2",
              "status": "affected",
              "version": "3.6.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Zephyr SDIO subsystem function sdio_io_rw_extended_helper() in subsys/sd/sdio.c finishes transfers with a byte-I/O loop that uses size = MIN(remaining, func-\u003ecis.max_blk_size) as the per-iteration step. The value func-\u003ecis.max_blk_size is decoded directly from the SDIO card\u0027s CIS FUNCE tuple in sdio_decode_cis() and is not validated. When a card reports a maximum block size of zero, size is always 0, remaining never decreases, and the loop spins forever.\n\nThe loop is reached from the public SDIO client API used by drivers, including sdio_read_fifo(), sdio_write_fifo(), and the incrementing register read/write helpers, each of which enters the loop while holding the per-card mutex func-\u003ecard-\u003elock. A card advertising max_blk_size == 0 therefore hangs the calling thread permanently on its first non-block-aligned transfer and never releases the mutex, denying service to the SDIO peripheral (and any subsystem such as Wi-Fi that depends on it) until the device is reset.\n\nThe malicious value must come from the SDIO card itself, so the defect is exploitable where a removable SDIO/combo card slot lets an attacker insert a crafted or malfunctioning card (a physical attack vector); on boards with a soldered SDIO peripheral it is not attacker-influenceable. There is no memory-safety, confidentiality, or integrity impact \u2014 only a permanent availability loss. The fix returns -EIO when func-\u003ecis.max_blk_size is zero, before the loop is entered."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 4.6,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-835",
              "description": "dos",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-14T16:12:52.263Z",
        "orgId": "e2e69745-5e70-4e92-8431-deb5529a81ad",
        "shortName": "zephyr"
      },
      "references": [
        {
          "name": "Fix commit",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/zephyrproject-rtos/zephyr/commit/3b2f7aaee1f2ca52904c7e7f028951ba39456abd"
        },
        {
          "name": "GHSA-4pvm-wrcp-jjf5",
          "url": "https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-4pvm-wrcp-jjf5"
        }
      ],
      "title": "Infinite loop denial of service in Zephyr SDIO byte-I/O from a card-supplied zero max_blk_size",
      "x_generator": {
        "engine": "cvelib 1.8.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "e2e69745-5e70-4e92-8431-deb5529a81ad",
    "assignerShortName": "zephyr",
    "cveId": "CVE-2026-15923",
    "datePublished": "2026-09-14T16:12:52.263Z",
    "dateReserved": "2026-07-16T04:55:24.186Z",
    "dateUpdated": "2026-09-14T19:40:10.205Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-15923",
      "date": "2026-09-15",
      "epss": "0.00167",
      "percentile": "0.06265"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-15923\",\"sourceIdentifier\":\"vulnerabilities@zephyrproject.org\",\"published\":\"2026-09-14T17:17:42.823\",\"lastModified\":\"2026-09-14T21:10:41.650\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"The Zephyr SDIO subsystem function sdio_io_rw_extended_helper() in subsys/sd/sdio.c finishes transfers with a byte-I/O loop that uses size = MIN(remaining, func-\u003ecis.max_blk_size) as the per-iteration step. The value func-\u003ecis.max_blk_size is decoded directly from the SDIO card\u0027s CIS FUNCE tuple in sdio_decode_cis() and is not validated. When a card reports a maximum block size of zero, size is always 0, remaining never decreases, and the loop spins forever.\\n\\nThe loop is reached from the public SDIO client API used by drivers, including sdio_read_fifo(), sdio_write_fifo(), and the incrementing register read/write helpers, each of which enters the loop while holding the per-card mutex func-\u003ecard-\u003elock. A card advertising max_blk_size == 0 therefore hangs the calling thread permanently on its first non-block-aligned transfer and never releases the mutex, denying service to the SDIO peripheral (and any subsystem such as Wi-Fi that depends on it) until the device is reset.\\n\\nThe malicious value must come from the SDIO card itself, so the defect is exploitable where a removable SDIO/combo card slot lets an attacker insert a crafted or malfunctioning card (a physical attack vector); on boards with a soldered SDIO peripheral it is not attacker-influenceable. There is no memory-safety, confidentiality, or integrity impact \u2014 only a permanent availability loss. The fix returns -EIO when func-\u003ecis.max_blk_size is zero, before the loop is entered.\"}],\"affected\":[{\"source\":\"vulnerabilities@zephyrproject.org\",\"affectedData\":[{\"vendor\":\"zephyrproject\",\"product\":\"zephyr\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://github.com/zephyrproject-rtos/zephyr\",\"packageName\":\"zephyr\",\"programFiles\":[\"subsys/sd/sdio.c\"],\"programRoutines\":[{\"name\":\"sdio_io_rw_extended_helper\"},{\"name\":\"sdio_read_addr\"},{\"name\":\"sdio_read_fifo\"},{\"name\":\"sdio_write_addr\"},{\"name\":\"sdio_write_fifo\"}],\"versions\":[{\"version\":\"3.6.0\",\"lessThan\":\"4.4.2\",\"versionType\":\"semver\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"vulnerabilities@zephyrproject.org\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":4.6,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"PHYSICAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":0.9,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-09-14T19:39:59.149731Z\",\"id\":\"CVE-2026-15923\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"vulnerabilities@zephyrproject.org\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-835\"}]}],\"references\":[{\"url\":\"https://github.com/zephyrproject-rtos/zephyr/commit/3b2f7aaee1f2ca52904c7e7f028951ba39456abd\",\"source\":\"vulnerabilities@zephyrproject.org\"},{\"url\":\"https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-4pvm-wrcp-jjf5\",\"source\":\"vulnerabilities@zephyrproject.org\"}]}}",
    "vulnrichment": {
      "containers": "{\"cna\": {\"providerMetadata\": {\"orgId\": \"e2e69745-5e70-4e92-8431-deb5529a81ad\", \"shortName\": \"zephyr\", \"dateUpdated\": \"2026-09-14T16:12:52.263Z\"}, \"title\": \"Infinite loop denial of service in Zephyr SDIO byte-I/O from a card-supplied zero max_blk_size\", \"descriptions\": [{\"lang\": \"en\", \"value\": \"The Zephyr SDIO subsystem function sdio_io_rw_extended_helper() in subsys/sd/sdio.c finishes transfers with a byte-I/O loop that uses size = MIN(remaining, func-\u003ecis.max_blk_size) as the per-iteration step. The value func-\u003ecis.max_blk_size is decoded directly from the SDIO card\u0027s CIS FUNCE tuple in sdio_decode_cis() and is not validated. When a card reports a maximum block size of zero, size is always 0, remaining never decreases, and the loop spins forever.\\n\\nThe loop is reached from the public SDIO client API used by drivers, including sdio_read_fifo(), sdio_write_fifo(), and the incrementing register read/write helpers, each of which enters the loop while holding the per-card mutex func-\u003ecard-\u003elock. A card advertising max_blk_size == 0 therefore hangs the calling thread permanently on its first non-block-aligned transfer and never releases the mutex, denying service to the SDIO peripheral (and any subsystem such as Wi-Fi that depends on it) until the device is reset.\\n\\nThe malicious value must come from the SDIO card itself, so the defect is exploitable where a removable SDIO/combo card slot lets an attacker insert a crafted or malfunctioning card (a physical attack vector); on boards with a soldered SDIO peripheral it is not attacker-influenceable. There is no memory-safety, confidentiality, or integrity impact \\u2014 only a permanent availability loss. The fix returns -EIO when func-\u003ecis.max_blk_size is zero, before the loop is entered.\"}], \"affected\": [{\"vendor\": \"zephyrproject\", \"product\": \"zephyr\", \"collectionURL\": \"https://github.com/zephyrproject-rtos/zephyr\", \"packageName\": \"zephyr\", \"defaultStatus\": \"unaffected\", \"programFiles\": [\"subsys/sd/sdio.c\"], \"programRoutines\": [{\"name\": \"sdio_io_rw_extended_helper\"}, {\"name\": \"sdio_read_addr\"}, {\"name\": \"sdio_read_fifo\"}, {\"name\": \"sdio_write_addr\"}, {\"name\": \"sdio_write_fifo\"}], \"versions\": [{\"version\": \"3.6.0\", \"status\": \"affected\", \"versionType\": \"semver\", \"lessThan\": \"4.4.2\"}]}], \"references\": [{\"url\": \"https://github.com/zephyrproject-rtos/zephyr/commit/3b2f7aaee1f2ca52904c7e7f028951ba39456abd\", \"name\": \"Fix commit\", \"tags\": [\"patch\"]}, {\"url\": \"https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-4pvm-wrcp-jjf5\", \"name\": \"GHSA-4pvm-wrcp-jjf5\"}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV3_1\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\", \"baseScore\": 4.6, \"baseSeverity\": \"MEDIUM\"}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"description\": \"dos\", \"cweId\": \"CWE-835\", \"type\": \"CWE\"}]}], \"x_generator\": {\"engine\": \"cvelib 1.8.0\"}}, \"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-15923\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-09-14T19:39:59.149731Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-09-14T19:40:05.606Z\"}}]}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-15923\", \"assignerOrgId\": \"e2e69745-5e70-4e92-8431-deb5529a81ad\", \"state\": \"PUBLISHED\", \"assignerShortName\": \"zephyr\", \"dateReserved\": \"2026-07-16T04:55:24.186Z\", \"datePublished\": \"2026-09-14T16:12:52.263Z\", \"dateUpdated\": \"2026-09-14T19:40:10.205Z\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.