ICMPv6 Reflection Vulnerability in Zephyr RTOS by Zephyr Project

CVE-2026-16515

What is CVE-2026-16515?

A vulnerability in Zephyr RTOS's handling of ICMPv6 messages can be exploited by unauthenticated attackers to launch network amplification attacks. Specifically, the flawed implementation of the net_icmpv6_send_error() function fails to adhere to key RFC 4443 suppression rules. This oversight permits attackers to send spoofed packets that cause all Zephyr nodes on a link to broadcast ICMPv6 Parameter Problem messages, effectively overwhelming the network and targeting selected victims. It particularly affects constrained mesh networks by flooding the link with multicast frames, leading to degraded availability for all connected devices. A proposed fix has been developed to strengthen this function and address the identified flaws.

References