Executive brief
A vulnerability exists in the Zephyr operating system's networking stack, specifically within the IPv6 Multicast Listener Discovery (MLD) component. An attacker on the same local network can send a specially crafted network packet that causes the system to access memory it has already released. This can lead to a system crash (denial of service) or, in rare cases, memory corruption, potentially disrupting the device's ability to communicate or operate reliably.
Technical details
A use-after-free vulnerability exists in `subsys/net/ip/ipv6_mld.c:mld_send()`. The function calls `net_pkt_iface(pkt)` to update statistics after `net_send_data(pkt)` has already returned successfully. In the Zephyr network stack, a successful send transfers ownership of the packet to the L2 driver, which may immediately free the object. If `CONFIG_NET_STATISTICS_PER_INTERFACE` is enabled, the subsequent access to the freed packet structure results in a dereference of a stale or NULL interface pointer. This is reachable via the `handle_mld_query()` path when the device processes a valid MLDv2 General Query from an adjacent attacker. The flaw is fixed by caching the interface pointer locally before calling the send function.
Affected products
- Zephyr Project Zephyr OS >= 1.12.0, <= 4.4.0
Timeline
- 2026-06-16: disclosed
- 2026-06-16: advisory: GHSA-m23w-34pp-4h92 published
- 2026-06-16: patched: Fix merged into main branch