Use-After-Free Vulnerability in Zephyr's IPv4 IGMP Implementation

CVE-2026-10636

What is CVE-2026-10636?

A use-after-free vulnerability exists in Zephyr's IPv4 IGMP implementation, specifically in the igmp_send() function within the subsys/net/ip/igmp.c file. When the packet is processed, it improperly accesses a freed packet structure if the packet's last reference is released before certain operations are completed. This flaw can be triggered without authentication through incoming IPv4 IGMP membership queries and local multicast operations, leading to undefined behavior, potential denial of service, and even sporadic application crashes. The issue was introduced with IGMPv2 support and affects multiple versions of the software. A patch has been provided that caches the necessary interface pointer before the send operation.

References