Executive brief
A vulnerability exists in the Zephyr real-time operating system's networking stack, which is used in many embedded and IoT devices. An attacker can send a specially crafted network request (such as a ping) that causes the system to crash or behave unpredictably. This could lead to a complete service outage for the affected device or potentially allow for further memory corruption.
Technical details
A use-after-free (UAF) vulnerability exists in 'subsys/net/ip/icmpv6.c' within the Zephyr networking stack. The functions 'icmpv6_handle_echo_request()' and 'net_icmpv6_send_error()' attempt to update interface statistics by calling 'net_pkt_iface()' on a packet that has already been passed to the 'net_try_send_data()' transmission path. Because the transmission path may unreference and free the packet memory before returning, the subsequent statistics update dereferences a stale pointer. When 'CONFIG_NET_STATISTICS_PER_INTERFACE' is enabled, this results in a write to an attacker-influenced memory location. An unauthenticated remote attacker can trigger this by sending ICMPv6 Echo Requests or packets that elicit ICMPv6 error responses. The issue is fixed by caching the interface pointer before initiating the send operation.
Affected products
- Zephyr Project Zephyr RTOS v4.2.0 to v4.4.0
Timeline
- 2026-06-16: advisory: NVD publication date
- 2026-06-16: disclosed: Vulnerability disclosed by Zephyr Project