Critical lwIP Embedded TCP/IP Stack Double Free Flaw Exposes Industrial Controllers to Remote Hijacking CVE-2026-91018

Executive Lead & Industrial Exposure Context

The Cybersecurity and Infrastructure Security Agency (CISA) has released Industrial Control Systems advisory ICSA-26-265-02, alerting asset owners and embedded firmware developers to a high-severity memory management defect in the lwIP (Lightweight IP) TCP/IP protocol suite. Tracked as CVE-2026-91018 with a CVSS v3.1 base score of 8.8 (High) (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), the vulnerability is classified under CWE-415: Double Free.

lwIP is the de facto standard lightweight networking stack used globally across resource-constrained microcontrollers (MCUs), real-time operating systems (RTOS) including FreeRTOS, Zephyr RTOS, and RT-Thread, as well as industrial Internet of Things (IIoT) edge gateways, building automation controllers, and smart grid telemetry transceivers. Because lwIP executes directly inside low-level system firmware often lacking hardware memory management units (MMUs) or virtual address sandboxing, an unauthenticated remote attacker capable of sending network packets to an affected device can trigger immediate controller hard faults or execute arbitrary code directly within the target's physical memory space.

Vulnerability Taxonomy & Affected Configurations

The defect is present across all core lwIP releases implementing API versions 2.0.1 through 2.2.1:

Component & Architecture	Vulnerable Versions	Fixed Commit / Release Baseline	Operational Attack Surface
Core lwIP TCP Engine (IPv4 & IPv6)	v2.0.1 through v2.2.1	Commit f873b6295933e4149a2132adf3e9a2d2a676a5ec / v2.2.2+	Unauthenticated remote network packets sent to any listening TCP port
FreeRTOS / TCP Networking Add-ons	Deployments utilizing lwIP packet buffer drivers	Vendor-provided BSP / SDK firmware update incorporating patch	Smart sensors, smart meters, medical infusion pumps, PLC ethernet daughterboards
Zephyr RTOS lwIP Subsystem	Zephyr releases prior to patch backport	Zephyr LTS v3.7.x / Main branch sync	Industrial IoT wireless gateways (BLE/Zigbee to IP), smart building HVAC
Proprietary PLC Field Devices	Firmware based on vendor SDKs (STMicroelectronics, NXP, TI, Renesas)	OEM firmware patch requiring OTA or physical JTAG/serial reflash	Purdue Model Level 1/2 field controllers, RTUs, and distributed I/O blocks

Root Cause Dissection: Packet Buffer (pbuf) Double Free (CWE-415)

lwIP optimizes network throughput in embedded architectures by utilizing a specialized zero-copy memory structure called the packet buffer (pbuf). A pbuf can represent single RAM allocations (PBUF_RAM), ROM references (PBUF_ROM), or linked lists of packet chunks allocated from fixed-size pools (PBUF_POOL).

Each pbuf maintains an internal atomic reference counter:

struct pbuf {
  struct pbuf *next;
  void *payload;
  u16_t tot_len;
  u16_t len;
  u8_t type_internal;
  u8_t flags;
  u8_t ref;  /* Reference count */
  /* ... */
};

Under normal TCP segment reassembly, when out-of-order packets arrive, the stack inserts pbuf chains into a segment queue (seg->p). When incoming TCP segments are out of sequence or overlap existing sequence windows, the reassembly logic in tcp_in.c trims or frees redundant buffers by calling pbuf_free(p).

In vulnerable versions (2.0.1 through 2.2.1), a logic flaw occurs in the TCP input state machine during specific out-of-window reassembly sequences involving malformed TCP headers with conflicting sequence numbers and payload lengths:

/* Flawed snippet in tcp_in.c during overlapping segment handling */
if (TCP_SEQ_LT(seqno, pcb->rcv_nxt)) {
  /* Trim segment prefix */
  if (pbuf_remove_header(p, pcb->rcv_nxt - seqno) == 0) {
    /* If trimmed length is 0, release buffer */
    pbuf_free(p);
  }
}

/* Later in error handling / duplicate check */
if (duplicate_segment_detected) {
  /* Flaw: p is freed AGAIN without checking whether it was already released */
  pbuf_free(p); /* DOUBLE FREE TRIGGERED */
}

When pbuf_free() is called a second time on the same pointer, the stack decrements the reference count below zero (wrapping around in unsigned arithmetic) or returns the memory block back to the memp_tab free list a second time. This creates a circular reference in the embedded heap free list.

Subsequent memory allocations by other tasks (such as RTOS scheduler structures or application telemetry buffers) receive overlapping memory pointers, causing rapid heap corruption.

Industrial OT Exploitation Trajectory & Purdue Model Blast Radius

In industrial operational technology (OT) environments, the consequence of remote heap corruption in an embedded stack is catastrophic:

[Attacker / Untrusted Network or Compromised L3 Workstation]
        |
        | 1. Transmit crafted TCP segments (overlapping SEQ/ACK windows)
        v
[Industrial Gateway / Edge PLC (Purdue Level 1/2)]
        |
        | 2. lwIP tcp_in.c processes packet reassembly
        | 3. Double free invoked on pbuf_free()
        | 4. Heap pool linked list corrupted with circular pointers
        |
        +---> [Scenario A: Denial of Service / Crash]
        |       MCU triggers HardFault_Handler; watchdog timer halts;
        |       assembly line or turbine control shuts down unexpectedly.
        |
        +---> [Scenario B: Memory Overwrite & RCE]
                Subsequent MQTT/Modbus packet allocation overlaps stack;
                adversary overwrites function return address;
                code execution hijacked without authentication.

Unlike enterprise Linux servers with Address Space Layout Randomization (ASLR), non-executable stacks (NX/DEP), and stack canaries, the vast majority of microcontrollers executing lwIP have static memory layouts compiled directly into internal SRAM. An attacker with reverse-engineered firmware can predictably redirect execution control to arbitrary shellcode or overwrite safety setpoints.

Firmware Patching & Defensive Playbook

Security teams and industrial operators must implement the following remediation framework:

1. Upstream Source Patch Integration

Firmware engineers maintaining embedded systems must apply upstream commit f873b6295933e4149a2132adf3e9a2d2a676a5ec to their lwIP source tree:

git diff f873b6295933e4149a2132adf3e9a2d2a676a5ec^!
# Ensure pbuf_free() is strictly guarded and pointers are cleared:
-  pbuf_free(p);
+  if (p != NULL) {
+    pbuf_free(p);
+    p = NULL;
+  }

2. Purdue Model Network Segmentation & Firewall Isolation

Until vendor firmware patches are qualified and flashed across operational plants, asset owners must isolate vulnerable embedded field devices from untrusted network segments:

• Block direct inbound TCP traffic to field controllers (Purdue Level 1 and 2) from enterprise IT networks (Level 4/5) and the Internet.
• Terminate all external administrative sessions at a dedicated Level 3 Demilitarized Zone (DMZ) jump host with multi-factor authentication.
• Employ industrial deep packet inspection (DPI) firewalls to drop malformed TCP packets with out-of-order sequence flags targeting PLC IP addresses.

3. Snort / Suricata Network Detection Rule

Deploy network intrusion detection signatures to monitor and alert on suspicious TCP reassembly anomalies targeting embedded controllers:

alert tcp any any -> $HOME_NET any (  msg:"CST THREAT-ALERT: lwIP TCP Reassembly Anomalous Overlap Attempt (CVE-2026-91018)";   flags:S,12;   content:"|00 00|"; offset:0; depth:2;   threshold:type limit, track by_src, count 5, seconds 60;   classtype:attempted-dos;   sid:202691018; rev:1;)