Remote Denial of Service in Zephyr RTOS due to IPv6 Reachable Time Configuration

CVE-2026-15893

What is CVE-2026-15893?

The Zephyr RTOS contains a vulnerability within the net_if_ipv6_calc_reachable_time() function that can be exploited to cause a remote denial of service. This issue arises when a malicious actor sends an unauthenticated Router Advertisement (RA) with a controlled Reachable Time value of 1, leading to a computed reachable time of 0. This, in turn, triggers a fatal kernel assertion on builds with CONFIG_ASSERT enabled, incapacitating the network service. Even on builds without assertions, the reachable timeout being set to 0 results in immediate re-solicitation of neighboring nodes, severely degrading IPv6 Neighbor Discovery services.

References