Executive brief
Zephyr is an operating system used in embedded and IoT devices. A flaw in its networking component allows a remote attacker to create a permanent loop of network traffic. This can lead to a 'forwarding storm' that exhausts the device's processing power and battery, potentially causing the device or its local network to become unresponsive.
Technical details
The vulnerability exists in the IPv6 forwarding logic within 'subsys/net/ip'. Specifically, both the explicit-route path (net_route_packet) and the on-link cross-interface path (net_route_packet_if) fail to decrement the IPv6 hop limit before re-sending routed unicast packets. Per RFC 8200, this decrement is essential for bounding packet lifetime. An attacker can exploit this by inducing a Layer 3 loop, which the vulnerable device will then sustain indefinitely. This results in a permanent forwarding storm, causing CPU and bandwidth exhaustion (DoS). The issue affects configurations where CONFIG_NET_ROUTE and CONFIG_NET_ROUTING are enabled. The fix involves properly decrementing the hop limit and implementing expiry checks in the routing branches.
Affected products
- Zephyr Project Zephyr RTOS 1.8.0 through 4.4.1
Timeline
- 2026-07-31: disclosed
- 2026-07-31: advisory