Executive brief
Zephyr is an open-source operating system for small, resource-constrained devices. A flaw in its networking component could allow a nearby attacker to cause a device to crash or behave unpredictably by sending specially crafted network traffic. This occurs because the system tries to record statistics using data from a network packet that has already been deleted from memory.
Technical details
A use-after-free (CWE-416) exists in Zephyr's IPv6 Neighbor Discovery send paths (net_ipv6_send_na, net_ipv6_send_ns, and net_ipv6_send_rs). The functions attempt to update ICMP statistics by calling net_pkt_iface(pkt) after the packet has already been passed to net_send_data(pkt). On successful transmission, the network stack or driver may have already unreferenced and freed the packet slab block. If CONFIG_NET_STATISTICS_PER_INTERFACE is enabled, the code dereferences a pointer from this freed memory to increment a counter. An unauthenticated attacker on the same local link can trigger this path by sending ICMPv6 Neighbor Solicitations. The vulnerability is fixed in version 4.5.0 by using a cached interface pointer instead of accessing the packet post-send.
Affected products
- Zephyr Project Zephyr RTOS v3.3.0 through v4.4.0
Timeline
- 2026-06-16: advisory: GHSA-r74c-mr4m-7g9g published
- 2026-06-16: disclosed: CVE-2026-10640 published
- 2026-06-16: patched: Fix merged into main branch