Use-After-Free Vulnerability in Zephyr Networking Stack

CVE-2026-10638

What is CVE-2026-10638?

A use-after-free vulnerability in the Zephyr networking stack occurs when the system improperly handles network packets within the ICMPv6 protocol. After a packet is sent, the system may dereference a pointer to the freed packet memory, allowing an unauthenticated remote attacker to exploit this flaw. By sending crafted ICMPv6 Echo Requests or IPv6 packets, the attacker may trigger a denial of service, resulting in application crashes and potential memory corruption due to incorrect updates to interface statistics. The issue affects versions v4.2.0 through v4.4.0, and proper cache handling before sending data has been implemented in a recent fix.

References