IPv6 Routing Vulnerability in Zephyr by Zephyr Project

CVE-2026-10686

What is CVE-2026-10686?

Zephyr's handling of IPv6 forwarding packets lacks proper hop limit management, allowing unicast packets to be endlessly relayed and potentially creating a denial of service condition. This vulnerability affects routing operations where the hop limit is not decremented, leading to indefinite packet looping. Attackers can exploit this issue to create persistent packet storms that exhaust network resources. All affected configurations having CONFIG_NET_ROUTE and CONFIG_NET_ROUTING enabled are at risk, with specific versions identified. Fixes have been implemented in later releases.

References