# CVE-2026-15923: Infinite loop denial of service in Zephyr SDIO byte-I/O from a card-supplied zero max_blk_size

Status: published. Published: 2026-09-14. Updated: 2026-11-04.

The Zephyr SDIO subsystem function sdio_io_rw_extended_helper() in subsys/sd/sdio.c finishes transfers with a byte-I/O loop that uses size = MIN(remaining, func->cis.max_blk_size) as the per-iteration step. The value func->cis.max_blk_size is decoded directly from the SDIO card's CIS FUNCE tuple in sdio_decode_cis() and is not validated. When a card reports a maximum block size of zero, size is always 0, remaining never decreases, and the loop spins forever.

The loop is reached from the public SDIO client API used by drivers, including sdio_read_fifo(), sdio_write_fifo(), and the incrementing register read/write helpers, each of which enters the loop while holding the per-card mutex func->card->lock. A card advertising max_blk_size == 0 therefore hangs the calling thread permanently on its first non-block-aligned transfer and never releases the mutex, denying service to the SDIO peripheral (and any subsystem such as Wi-Fi that depends on it) until the device is reset.

The malicious value must come from the SDIO card itself, so the defect is exploitable where a removable SDIO/combo card slot lets an attacker insert a crafted or malfunctioning card (a physical attack vector); on boards with a soldered SDIO peripheral it is not attacker-influenceable. There is no memory-safety, confidentiality, or integrity impact — only a permanent availability loss. The fix returns -EIO when func->cis.max_blk_size is zero, before the loop is entered.

## Remediation

- fix: The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches. (source: CNA: zephyr) — https://github.com/zephyrproject-rtos/zephyr/commit/3b2f7aaee1f2ca52904c7e7f028951ba39456abd

## Affected products and versions

- zephyrproject / zephyr (zephyr): ≥ 3.6.0; < 4.3.2 (affected, semver); ≥ 4.4.0; < 4.4.2 (affected, semver). Source: CNA: zephyr

## Severity and prioritization

- CVSS 3.1: 4.6 (medium); CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H; source: CNA: zephyr

- CVSS 3.1: 4.6 (medium); CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H; source: NVD: vulnerabilities@zephyrproject.org

- CISA KEV: No listing in collected sources

- EPSS: 0.23% as of 2026-11-03; percentile 13.95%

- SSVC: exploitation none; automatable no; technical impact partial; source ADP: CISA-ADP

- Weaknesses: CWE-835

## Exploit evidence

No exploit evidence in collected sources. This is not proof of no exploitation.

## References

- https://github.com/zephyrproject-rtos/zephyr/commit/3b2f7aaee1f2ca52904c7e7f028951ba39456abd (CNA: zephyr; patch)

- https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-4pvm-wrcp-jjf5 (CNA: zephyr)

- https://github.com/zephyrproject-rtos/zephyr/commit/3b2f7aaee1f2ca52904c7e7f028951ba39456abd (vulnerabilities@zephyrproject.org)

- https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-4pvm-wrcp-jjf5 (vulnerabilities@zephyrproject.org)

## Provenance

- CNA: zephyr: https://www.cve.org/CVERecord?id=CVE-2026-15923; retrieved 2026-11-04; source updated 2026-11-04

- NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-15923; retrieved 2026-11-04; source updated 2026-11-04

- FIRST EPSS: https://api.first.org/data/v1/epss?cve=CVE-2026-15923; retrieved 2026-11-04; source updated Not reported

Revision: b71fe0866fb67ca050632374dd68c8f632d97d65a20ba690d2b98c2bbc49e63b

Canonical: https://y2.dev/cve/CVE-2026-15923

## Agent and API access

Public CVE pages, Markdown, and JSON are free to read without an account or API key.

- Public catalog: https://y2.dev/cve/index.json. Follow nextCursor with the same search, filters, sort, and limit (1–100). A null cursor marks the end.

- WebMCP: search_cve_disclosures, get_cve_disclosure, get_cve_page_markdown, get_y2_cve_access. Available in compatible browsers.

- Cyber API: https://api.y2.dev/api/v2/cyber/cves and https://api.y2.dev/api/v2/cyber/cves/{cveId}.

- Y2 Pro or Elite: create a workspace API key with the intel:cyber scope and send Authorization: Bearer <Y2_API_KEY>. Setup: https://y2.dev/docs/api/create-key.

- x402: Pay per request without an account or API key. Omit Authorization, read the HTTP 402 PAYMENT-REQUIRED challenge, validate its current requirements, and retry with PAYMENT-SIGNATURE through an authorized payment client. These browser tools never make payments. Guide: https://y2.dev/docs/api/x402.

- OpenAPI: https://y2.dev/api/openapi.yaml. Agent access metadata: https://y2.dev/cve/agent.json.

Collected public records only. Check source status for coverage and freshness.