RE: CVE-2026-10646 mitigation in SDK 3.4.0?

Amanda Hsieh — Mon, 06 Jul 2026 13:33:10 GMT

Hi Alejandro,

The fix is not yet present in NCS v3.4.0. It should be included in NCS v3.4.1.

[quote user=""]In the case that there are no plans to release this patch in the short term, is it possible to force the project to point to a given version of the Zephyr repository, or will it collide with any internal SDK / toolchain check? We use the nRF extensions for VS Code, and very seldom execute raw 'west' commands.[/quote]

This won't work. NCS cannot work with upstream Zephyr directly, as our fork (sdk-zephyr) has some out-of-tree patches. The only short-term solution I see is to cherry-pick the commit with the fix manually to the local sdk-zephyr instance. Here is the PR for sdk-zephyr (towards ncs-v3.4-branch): net: Cherry-pick bugfixes from upstream by rlubos · Pull Request #4266 · nrfconnect/sdk-zephyr

Regards,
Amanda H.