CVE-2026-19735

Executive Summary

CVE-2026-19735 is a cryptographic weakness in the RFC 6528 TCP Initial Sequence Number (ISN) implementation in the Zephyr RTOS network stack (subsys/net/ip/tcp.c). When the cryptographic random source fails once during early boot, the 128-bit ISN secret is left as all-zero BSS content with no retry, no log and no fallback, causing every TCP connection to derive predictable sequence numbers. Systems running affected Zephyr builds — particularly listening services reachable immediately after boot — are affected; the primary impact is reduced confidentiality and integrity of TCP sessions (CVSS 4.8, AV:N/AC:H).

Technical Analysis

The implementation derives every TCP ISN from SHA-256(unique_key || four-tuple) plus an uptime-derived offset. The unique_key is intended to be a 128-bit secret populated once via sys_csrand_get(). Two defects combine:

1. Discarded return value / premature guard latching. The return value of sys_csrand_get() was discarded, and the "once" guard was latched to true even when the call failed. There is no retry and no error propagation.
2. No buffer write on failure. sys_csrand_get() deliberately leaves the destination buffer untouched on failure (it propagates the entropy-driver error rather than filling the buffer). Consequently, a single failed call leaves unique_key as its all-zero BSS content for the remainder of the boot, with no retry, no log message and no fallback.

The weak state is only reachable via a failure of the cryptographic random source — for example -ENODEV/-EIO from the entropy driver in subsys/random/random_entropy_device.c (the in-tree comment notes the hardware RNG "might still be gathering entropy during early boot situations"), or psa_generate_random() failing in subsys/random/random_psa.c when PSA crypto is not initialised or is backed by a Bluetooth-HCI entropy device that is not yet up.

Key generation is triggered by the first TCP connection. tcp_init_isn() is called for every passive open in tcp_conn_new() and every active open in net_tcp_connect(), so the poisoned key governs all TCP connections for the remainder of the boot. Because generation coincides with the first connection, a remote peer that reaches a listening port immediately after boot — or that can provoke a reboot — has indirect influence over whether generation lands in the entropy-starved window. The attack surface is therefore any Zephyr device exposing TCP services where the entropy driver is unavailable or uninitialized at the moment of first connection.

The relevant weakness class is CWE-330 (Use of Insufficiently Random Values). The Cisco/RFC 6528 protection goal — making ISN prediction infeasible for off-path attackers — is fully defeated when unique_key is constant and known (all zeros) and the only remaining variable is an uptime-derived offset.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class and the described mechanism.

1. Reconnaissance / target identification. Identify Zephyr-based devices exposing TCP listeners (for example MQTT 1883, HTTP/CoAP services, or custom TCP ports). Targets of interest are devices rebooted recently or frequently, since the poisoned key persists only from the boot in which the entropy failure occurred.
2. Triggering the flaw class. The attacker does not need code execution: the weak state is a precondition created by an entropy-source failure during early boot combined with the first TCP connection. An attacker reaching a listening port immediately after boot may cause ISN generation to occur inside the entropy-starved window. Where the attacker can provoke or observe reboots (power cycling, watchdog resets, or forced crash of a service), they can increase the probability that the first connection coincides with source failure.
3. Exploitation at the vulnerability-class level. With a known (all-zero) unique_key and an uptime-derived offset, the ISN becomes a deterministic function of the observable four-tuple (source/destination addresses and ports) and time. An off-path attacker can compute or narrow the expected ISN for a target connection, enabling blind TCP session injection/spoofing — forging packets into an established or in-progress connection without seeing the responses.
4. Post-exploitation impact. Successful ISN prediction enables TCP spoofing/injection affecting confidentiality and integrity of the session. Depending on the protocol carried over the spoofed connection, this can translate into command injection into device control channels, falsified telemetry, or denial of a legitimate session. The CVSS vector (S:U/C:L/I:L/A:N) acknowledges limited confidentiality and integrity impact without availability impact.

Impact Assessment

Business impact centers on loss of trust in TCP session integrity for Zephyr-based embedded and IoT endpoints. The CVSS 3.1 base score is 4.8 (Medium) with subscores AV:N (remotely reachable), AC:H (requires the entropy-failure precondition and timing alignment), PR:N (no privileges needed), UI:N (no user interaction), S:U (impact confined to the vulnerable component), C:L and I:L (limited confidentiality and integrity loss), A:N (no availability impact).

Blast radius is bounded by the entropy-failure precondition but broad within that boundary: because tcp_init_isn() is invoked for both passive opens (tcp_conn_new()) and active opens (net_tcp_connect()), a single poisoned key affects all TCP connections for the remainder of the boot — every listener and every outbound connection on that device. Devices whose entropy driver is routinely unavailable at first connection (for example PSA crypto not yet initialised, or a Bluetooth-HCI entropy device not yet up) are at elevated exposure. No CISA KEV listing and no known in-the-wild exploitation have been recorded, so current risk is architectural rather than actively exploited.

Detection Guidance

Sigma Rule

title: Zephyr TCP ISN Entropy Failure Indicators (CVE-2026-19735)
id: 7c1e9b2a-4f3d-4a10-9c2e-cve202619735
status: experimental
description: Detects boot-time entropy source failures preceding TCP ISN key generation on Zephyr RTOS devices
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-19735
author: valtersit.com
date: 2026/01/01
logsource:
  product: linux
  service: syslog
detection:
  selection_entropy:
    - 'random_entropy_device'
    - 'random_psa'
    - 'psa_generate_random'
  selection_failure:
    - '-ENODEV'
    - '-EIO'
    - 'entropy'
    - 'not initialised'
    - 'not initialized'
  selection_boot:
    - 'tcp_init_isn'
    - 'sys_csrand_get'
    - 'net_tcp_connect'
  condition: selection_entropy and selection_failure and selection_boot
falsepositives:
  - Legitimate early-boot entropy driver probing on hardware RNG devices
level: medium
tags:
  - attack.t1190
  - cwe.330

YARA Rule

rule CVE_2026_19735_Zephyr_TCP_ISN_Weak_Key
{
    meta:
        description = "Detects Zephyr firmware containing the vulnerable TCP ISN key generation pattern (CVE-2026-19735)"
        author = "valtersit.com"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-19735"
        cwe = "CWE-330"

    strings:
        $s1 = "unique_key" ascii
        $s2 = "tcp_init_isn" ascii
        $s3 = "sys_csrand_get" ascii
        $s4 = "net_tcp_connect" ascii
        $s5 = "tcp_conn_new" ascii
        $s6 = "random_entropy_device" ascii
        $s7 = "psa_generate_random" ascii
        $s8 = "random_psa" ascii

    condition:
        uint32be(0) == 0x7f454c46 and
        (
            (2 of ($s1, $s2, $s3, $s4, $s5)) or
            (2 of ($s6, $s7, $s8) and $s3)
        )
}

Suricata IDS Rule

alert tcp any any -> any any (msg:"CVE-2026-19735 Suspicious Zephyr TCP ISN Pattern - Repeated Sequential Sequence Numbers"; flow:established; threshold: type both, track by_src, count 5, seconds 30; byte_test:4,<=,0x00010000,0,relative; classtype:attempted-recon; sid:202619735; rev:1; reference:cve,2026-19735; metadata:affected_product Zephyr_RTOS, attack_target IoT_Device, created_at 2026_01_01, cve CVE_2026_19735;)

Elastic Detection

sequence by host.id with maxspan=10s
  // Entropy source failure during boot
  [ process where process.name != null and
      process.args : ("random_entropy_device", "random_psa", "psa_generate_random") and
      event.outcome == "failure" ]
  // Immediately followed by first TCP connection driving ISN key generation
  [ network where event.type == "start" and network.transport == "tcp" and
      network.direction == "outbound" ]

Splunk SPL Query

index=main ("tcp_init_isn" OR "sys_csrand_get" OR "unique_key" OR "random_entropy_device" OR "psa_generate_random")
| eval entropy_fail=if(match(_raw, "(?i)-ENODEV|-EIO|entropy.*fail|not initialis|not initializ"), 1, 0)
| eval isn_gen=if(match(_raw, "(?i)tcp_init_isn|sys_csrand_get|net_tcp_connect|tcp_conn_new"), 1, 0)
| where entropy_fail=1 OR isn_gen=1
| stats count by host, sourcetype, entropy_fail, isn_gen
| where count > 0
| sort - count

Wazuh OSSEC Rule

<group name="zephyr,cve_2026_19735,">
  <rule id="100735" level="8">
    <decoded_as>syslog</decoded_as>
    <match>random_entropy_device|random_psa|psa_generate_random</match>
    <match>-ENODEV|-EIO|entropy|not initialis|not initializ</match>
    <description>CVE-2026-19735: Zephyr entropy source failure may leave TCP ISN key uninitialised (all-zero)</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cwe_330,</group>
  </rule>
  <rule id="100736" level="6">
    <decoded_as>syslog</decoded_as>
    <match>tcp_init_isn|sys_csrand_get|net_tcp_connect|tcp_conn_new</match>
    <description>CVE-2026-19735: Zephyr TCP ISN key generation triggered on first connection</description>
    <group>cwe_330,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix, workaround or affected-version list is available in the provided intelligence.

1. Immediate mitigations

   • Do not latch the "once" guard on failure: treat a failed sys_csrand_get() as non-fatal but unset, so key generation is retried on the next connection attempt rather than remaining at all-zero BSS content.
   • Validate the return value of sys_csrand_get() and refuse to generate TCP ISNs until a valid key has been obtained; log a clear error when the source fails.
   • Populate unique_key alongside other boot-time secrets using a dedicated secret-scrubber path, and explicitly zero/refresh the buffer on failure rather than leaving it untouched.
   • Where feasible, defer initialising listening TCP services until the entropy source is confirmed available (hardware RNG fully seeded, PSA crypto initialised, Bluetooth-HCI entropy device up).
   • Reduce reboot exposure for critical devices; prevent unauthenticated reboot triggers.

2. Patch / upgrade steps

   • Monitor the upstream Zephyr project and CVE-2026-19735 tracking for a fixed release; no fixed version is identified here. Until one is published, apply the source-level mitigations above in local builds of subsys/net/ip/tcp.c and the entropy wiring in subsys/random/.
   • Rebuild and reflash affected firmware once a fix is available, and verify key-generation behaviour under simulated entropy-driver failure.

3. Long-term hardening

   • Adopt fail-closed crypto randomness handling across the RTOS: never discard sys_csrand_get()/psa_generate_random() return values for security-sensitive material.
   • Add regression tests that inject entropy-driver failures (-ENODEV/-EIO) and assert that ISN keys are never all-zero.
   • Harden boot sequencing so cryptographic subsystems initialise before network listeners accept connections, and add runtime monitoring for entropy-health telemetry.

References

• NVD — CVE-2026-19735: https://nvd.nist.gov/vuln/detail/CVE-2026-19735
• RFC 6528 — Defending Against Sequence Number Attacks: https://www.rfc-editor.org/rfc/rfc6528
• CWE-330 — Use of Insufficiently Random Values: https://cwe.mitre.org/data/definitions/330.html
• Zephyr Project — Network stack (subsys/net/ip/tcp.c) and random subsystem (subsys/random/): https://github.com/zephyrproject-rtos/zephyr
• CISA Known Exploited Vulnerabilities catalog — CVE-2026-19735 NOT listed (no exploit-in-the-wild evidence as of this report).