---
id: CVE-2026-15923
title: >-
  The Zephyr SDIO subsystem function sdio_io_rw_extended_helper() in
  subsys/sd/sdio.c finishes transfers with a byte-I/O loop that uses size =
  MIN(remaining, func->cis.max_blk_size) as the per-iteration step
summary: >-
  The Zephyr SDIO subsystem function sdio_io_rw_extended_helper() in
  subsys/sd/sdio.c finishes transfers with a byte-I/O loop that uses size =
  MIN(remaining, func->cis.max_blk_size) as the per-iteration step. The value
  func->cis.max_blk_si…
severity: medium
cvss: 4.6
cvssVector: 'CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
cwe:
  - CWE-835
vendor: zephyrproject
product: zephyr
affected:
  - zephyr >= 3.6.0 < 4.4.2
published: '2026-09-14'
updated: '2026-09-14'
sourceUpdated: '2026-09-14T21:10:41.650'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-15923'
references:
  - url: >-
      https://github.com/zephyrproject-rtos/zephyr/commit/3b2f7aaee1f2ca52904c7e7f028951ba39456abd
    label: vulnerabilities@zephyrproject.org
  - url: >-
      https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-4pvm-wrcp-jjf5
    label: vulnerabilities@zephyrproject.org
tags:
  - nvd
  - cve.org
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-14T19:39:59.149731Z'
ingestedAt: '2026-09-14T18:12:17.159Z'
epss: 0.00167
epssPercentile: 0.05225
---

## Overview

The Zephyr SDIO subsystem function sdio_io_rw_extended_helper() in subsys/sd/sdio.c finishes transfers with a byte-I/O loop that uses size = MIN(remaining, func->cis.max_blk_size) as the per-iteration step. The value func->cis.max_blk_size is decoded directly from the SDIO card's CIS FUNCE tuple in sdio_decode_cis() and is not validated. When a card reports a maximum block size of zero, size is always 0, remaining never decreases, and the loop spins forever.

The loop is reached from the public SDIO client API used by drivers, including sdio_read_fifo(), sdio_write_fifo(), and the incrementing register read/write helpers, each of which enters the loop while holding the per-card mutex func->card->lock. A card advertising max_blk_size == 0 therefore hangs the calling thread permanently on its first non-block-aligned transfer and never releases the mutex, denying service to the SDIO peripheral (and any subsystem such as Wi-Fi that depends on it) until the device is reset.

The malicious value must come from the SDIO card itself, so the defect is exploitable where a removable SDIO/combo card slot lets an attacker insert a crafted or malfunctioning card (a physical attack vector); on boards with a soldered SDIO peripheral it is not attacker-influenceable. There is no memory-safety, confidentiality, or integrity impact — only a permanent availability loss. The fix returns -EIO when func->cis.max_blk_size is zero, before the loop is entered.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.