Memory Corruption and Denial of Service in Zephyr Networking Stack

CVE-2026-10637

What is CVE-2026-10637?

A vulnerability in the Zephyr Networking Stack allows for the potential corruption of memory and denial of service through a flaw in the MLD query handling process. Specifically, the issue arises when packets are processed after ownership has been transferred to the layer 2 driver, resulting in operations on freed objects. If exploited, this vulnerability can be triggered remotely, leading to a crash or erratic application behavior due to dereferenced stale pointers. The recommended fix involves caching the interface before sending, preventing any interactions with the packet post-transfer, thus enhancing stability and security.

References