Executive brief
Zephyr is an open-source operating system designed for resource-constrained Internet of Things (IoT) devices. A flaw in how the system handles certain IPv4 network traffic (IGMP) could allow a remote attacker to cause a device to crash or behave unpredictably. This occurs because the system attempts to access data from a network packet after that packet has already been processed and released from memory.
Technical details
A use-after-free (UAF) vulnerability exists in `subsys/net/ip/igmp.c` within the `igmp_send()` function. The root cause is that the code calls `net_pkt_iface(pkt)` to retrieve the network interface pointer after the packet has been passed to `net_send_data()`. In common configurations (NET_TC_TX_COUNT=0), the packet's reference count may reach zero and be returned to the memory slab before `igmp_send()` finishes. If `CONFIG_NET_STATISTICS_PER_INTERFACE` is enabled, the resulting dangling pointer is dereferenced to update statistics. An unauthenticated remote attacker can trigger this path by sending IPv4 IGMP membership queries to the 224.0.0.1 multicast address. The vulnerability was fixed in version 4.5.0 by caching the interface pointer before the packet is sent.
Affected products
- Zephyr Project Zephyr OS v2.6.0 through v4.4.0
Timeline
- 2021-04: other: Vulnerability introduced in v2.6.0 with IGMPv2 support
- 2026-06-16: advisory: GHSA-fj6q-975v-65c9 published
- 2026-06-16: disclosed