In Zephyr versions 4.2.0 through before 4.5.0 with CONFIG_NET_NATIVE_IPV6 enabled, the ICMPv6 code reads the network interface pointer from a net_pkt after the packet has been passed to net_try_send_data(), which may free the packet synchronously or asynchronously. This results in a use-after-free condition when net_pkt_iface() dereferences a freed packet pointer. When per-interface statistics are enabled, this stale pointer is further dereferenced and written to, causing memory corruption. The vulnerability can be triggered remotely by unauthenticated attackers sending ICMPv6 Echo Requests or packets eliciting ICMPv6 errors, leading to denial of service via crash and potential memory corruption. The fix involves caching the interface pointer before sending and using it for statistics updates. A similar fix was applied for ICMPv4.

An unauthenticated remote attacker can trigger this vulnerability by sending ICMPv6 Echo Requests or packets that cause ICMPv6 errors, resulting in a use-after-free condition. This leads to denial of service through application crashes and may cause memory corruption. There is no impact on confidentiality or integrity reported. The vulnerability affects availability of the affected Zephyr networking stack.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The described fix caches the interface pointer before sending to avoid use-after-free. Until an official fix is confirmed and applied, users should consider disabling CONFIG_NET_STATISTICS_PER_INTERFACE or CONFIG_NET_NATIVE_IPV6 as potential temporary mitigations, if feasible. Monitor official Zephyr project advisories for patches addressing this issue.