Executive brief
Zephyr RTOS is a real-time operating system used in embedded devices and IoT systems to manage low-level hardware and networking. A flaw in how the system calculates IPv6 neighbor reachability timers can be exploited by sending a specially crafted network packet from an adjacent attacker, causing the device to either crash (if assertions are enabled) or enter a degraded state where it continuously re-solicits neighbors, disrupting network communication and availability.
Technical details
The vulnerability is an integer arithmetic error in net_if_ipv6_calc_reachable_time() in subsys/net/ip/net_if.c. The function computes a randomized ND reachable time using the formula: min_reachable + rand() % (max_reachable - min_reachable), where min_reachable = base/2 and max_reachable = 3*base/2. When base_reachable_time is 1, both min_reachable and the modulus become 0 due to integer division, causing the function to return 0. An attacker can trigger this by sending an unauthenticated Router Advertisement packet with Reachable Time field set to 1, which is accepted by handle_ra_input() in subsys/net/ip/ipv6_nbr.c as valid (nonzero and ≤ MAX_REACHABLE_TIME). The zero value stored in ipv6->reachable_time subsequently triggers a fatal kernel assertion (on CONFIG_ASSERT=y builds) or causes reachable neighbors to perpetually enter STALE state, degrading Neighbor Discovery. Attack requires only link-local adjacency; no authentication is needed.
Affected products
- Zephyr Project Zephyr RTOS versions prior to commit 251079ed50464aa0976eb0738a5afbe009cc9d60
Timeline
- 2026-09-14: disclosed: CVE-2026-15893 published on NVD
- 2026-09-14: patched: Fix committed as GitHub commit 251079ed50464aa0976eb0738a5afbe009cc9d60