CVE-2026-88718

It appears there might be a slight discrepancy in the CVE ID provided. While CVE-2026-88718 does not appear in popular articles, information is available for CVE-2026-8718, which was published on August 10, 2026. Assuming this is the intended vulnerability, CVE-2026-8718 describes an out-of-bounds write flaw found in the `tls_opt_dtls_peer_connection_id_value_get()` function within `subsys/net/lib/sockets/sockets_tls.c`. This vulnerability occurs because the function, which handles `getsockopt(SOL_TLS, TLS_DTLS_PEER_CID_VALUE)`, passes a caller-supplied `optval` directly to `mbedtls_ssl_get_peer_cid()` without adequately verifying the buffer's size. If the provided `optlen` is smaller than the DTLS Connection ID (CID), `mbedtls_ssl_get_peer_cid()` can write up to 31 bytes beyond the buffer's allocated memory. In `CONFIG_USERSPACE` builds, an unprivileged user can trigger a kernel-heap buffer overflow by providing a small `optlen` on a connected DTLS socket with Connection ID enabled, leading to the remote peer's CID overflowing the kernel buffer. The issue requires `CONFIG_MBEDTLS_SSL_DTLS_CONNECTION_ID`, an established DTLS session with a negotiated peer CID, and `CONFIG_USERSPACE` for kernel-level exploitation.