IPv6 Neighbor Discovery Vulnerability in Zephyr by Zephyr Project

CVE-2026-10640

What is CVE-2026-10640?

The IPv6 Neighbor Discovery paths in Zephyr contain a vulnerability that allows unauthenticated on-link nodes to exploit memory handling issues. Specifically, after sending ICMPv6 Neighbor Solicitation messages, incorrect handling of packet statistics can lead to a use-after-free condition, potentially resulting in corrupted statistics or a denial of service. This vulnerability affects versions from 3.3.0 to 4.4.0 of the Zephyr OS, with the exploitation risk significantly heightened due to the accessibility of the affected paths. The fix implements safer memory handling by utilizing existing interface arguments, minimizing the chance of memory corruption.

References