Executive brief
A logic error in the Zephyr real-time operating system allows attackers to bypass security checks for IPv6 network traffic. By sending specially crafted network packets, an attacker can trick a device into reconfiguring its internet settings, redirecting its traffic, or knocking it offline. This could lead to a loss of network connectivity or allow an attacker to intercept sensitive data passing through the device.
Technical details
A vulnerability in the IPv6 Neighbor Discovery (ND) handlers (handle_ra_input, handle_ns_input, handle_na_input) in Zephyr's subsys/net/ip/ipv6_nbr.c stems from incorrect operator precedence in boolean expressions. The code used the form '((validation checks) && (icmp_hdr-code != 0))' to determine if a packet should be dropped. Since legitimate ND packets use an ICMPv6 code of 0, the entire expression evaluates to false, causing the system to skip critical security checks such as Hop Limit verification (RFC 4861) and source address validation. An attacker can exploit this to inject forged Router Advertisements (RA), Neighbor Solicitations (NS), and Neighbor Advertisements (NA). This enables rogue router injection, SLAAC prefix manipulation, DNS hijacking via RDNSS, and neighbor-cache poisoning. While primarily an adjacent-link attack, the bypass of the Hop Limit check potentially allows remote attackers to inject packets that would otherwise be dropped by the network stack. The issue is fixed in Zephyr v4.5.0 and backported to various LTS branches.
Affected products
- Zephyr Project Zephyr 1.14.0 to 4.4.0
Timeline
- 2026-06-25: other: Embargo date
- 2026-06-29: advisory: GHSA-cpjw-rvwx-ph9f published
- 2026-06-29: disclosed: CVE-2026-7656 published