Out-of-bounds write in Zephyr recvmsg() ancillary data handling

CVE-2026-10643 is a memory corruption vulnerability in Zephyr’s IP socket recvmsg() ancillary-data handling, specifically in insert_pktinfo() in subsys/net/lib/sockets/sockets_inet.c. The implementation validated the user-supplied msg_control buffer using only the ancillary payload length (msg->msg_controllen < pktinfo_len) before writing a full control message composed of an aligned cmsg header plus payload. Because the check omitted the cmsg header size, undersized control buffers could pass validation and then be overrun during control message construction. For example, for IPv4 IP_PKTINFO on a 64-bit target, buffers in the 16-27 byte range can pass the check even though one control message element requires 28 bytes. This results in a fixed-size out-of-bounds write of up to approximately one cmsg header (~12 bytes) past the end of the buffer. In CONFIG_USERSPACE builds, recvmsg verification allocates a kernel-heap copy of the control buffer sized to msg_controllen and executes the vulnerable path against it, making the overflow a kernel-heap corruption reachable by an unprivileged userspace thread. In supervisor mode, the overflow corrupts the caller-provided buffer. Affected versions are Zephyr v3.6.0 through v4.4.0.