In Zephyr version 1.12.0, the function mld_send() in subsys/net/ip/ipv6_mld.c accesses the network packet interface after the packet has been sent and freed, violating the network stack's ownership contract. After net_send_data(pkt) returns successfully, the packet is freed by the L2 driver, but mld_send() still reads pkt->iface, leading to a use-after-free condition. This can cause a NULL-pointer dereference or memory corruption if the freed memory is reallocated concurrently. The vulnerability is remotely exploitable on the local link by sending a valid MLDv2 General Query, resulting in a denial of service of the networking stack and a narrow possibility of memory corruption. The fix involves caching the interface locally before sending and not accessing the packet after net_send_data().

The vulnerability allows an unauthenticated attacker on the local network link to remotely trigger a denial of service by causing the networking stack to crash due to use-after-free or NULL-pointer dereference. There is also a narrow possibility of memory corruption, which could potentially lead to further instability or exploitation, although no exploits are known in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The vendor has described a fix that caches the interface before sending and avoids accessing the packet after net_send_data(), but no official patch or remediation level is currently provided. Until a patch is available, network administrators should consider limiting exposure to untrusted local link traffic that can send MLDv2 General Queries if feasible.