CVE-2026-10638: use-after-free in zephyrproject zephyr
subsys/net/ip/icmpv6.c reads the network interface from a net_pkt after that packet has been handed to net_try_send_data(). In icmpv6_handle_echo_request() and net_icmpv6_send_error(), the post-send statistics update calls net_pkt_iface(reply)/net_pkt_iface(pkt) on the just-sent packet. The send path (net_try_send_data -> net_if_tx) unreferences and may free the packet back to its memory slab before returning — synchronously in the RX thread when no TX queue is configured (CONFIG_NET_TC_TX_COUNT == 0), and asynchronously the driver/L2 may already have freed it otherwise. net_pkt_iface() therefore dereferences a freed (and possibly reused) net_pkt; with CONFIG_NET_STATISTICS_PER_INTERFACE the stale iface pointer is further dereferenced and written through (iface->stats.icmp.sent++), turning the use-after-free read into a write through an attacker-influenceable pointer. The core stack already documents this hazard in net_core.c ("do not use pkt after that call") and caches iface before sending; the ICMPv6 callers did not. An unauthenticated remote attacker triggers the flaw simply by sending an ICMPv6 Echo Request (ping) or an IPv6 packet that elicits an ICMPv6 error (unknown next header, fragment reassembly timeout, destination unreachable), leading to denial of service via crash and potential memory corruption. Affected: Zephyr networking with CONFIG_NET_NATIVE_IPV6, roughly v4.2.0 through v4.4.0. The fix caches the interface pointer before sending and uses it for all statistics updates; the sibling commit 86e21665d46 fixes the identical bug in ICMPv4.
AI Analysis
Technical Summary
In Zephyr's networking stack, specifically in subsys/net/ip/icmpv6.c, the code reads the network interface from a net_pkt after the packet has been passed to net_try_send_data(). The send path may free the packet synchronously or asynchronously, causing net_pkt_iface() to dereference a freed packet. This leads to a use-after-free condition that can escalate to writing through an attacker-controllable pointer when per-interface statistics are enabled. The vulnerability can be triggered remotely without authentication by sending ICMPv6 Echo Requests or packets that generate ICMPv6 errors. The root cause is that the ICMPv6 handlers do not cache the interface pointer before sending, unlike the core stack. The fix involves caching the interface pointer before sending and using it for statistics updates. The affected versions are approximately Zephyr v4.2.0 through v4.4.0 with CONFIG_NET_NATIVE_IPV6. No official patch or remediation level is stated in the provided data.
Potential Impact
An unauthenticated remote attacker can cause a denial of service by crashing the system or potentially cause memory corruption by exploiting the use-after-free vulnerability in the ICMPv6 handling code. This impacts the availability and potentially the integrity of affected Zephyr systems configured with native IPv6 networking.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The described fix involves caching the interface pointer before sending packets to avoid use-after-free. Until an official fix is applied, consider disabling CONFIG_NET_NATIVE_IPV6 if feasible to mitigate exposure. Monitor vendor channels for an official patch or update.
CVE-2026-10638: use-after-free in zephyrproject zephyr
Description
subsys/net/ip/icmpv6.c reads the network interface from a net_pkt after that packet has been handed to net_try_send_data(). In icmpv6_handle_echo_request() and net_icmpv6_send_error(), the post-send statistics update calls net_pkt_iface(reply)/net_pkt_iface(pkt) on the just-sent packet. The send path (net_try_send_data -> net_if_tx) unreferences and may free the packet back to its memory slab before returning — synchronously in the RX thread when no TX queue is configured (CONFIG_NET_TC_TX_COUNT == 0), and asynchronously the driver/L2 may already have freed it otherwise. net_pkt_iface() therefore dereferences a freed (and possibly reused) net_pkt; with CONFIG_NET_STATISTICS_PER_INTERFACE the stale iface pointer is further dereferenced and written through (iface->stats.icmp.sent++), turning the use-after-free read into a write through an attacker-influenceable pointer. The core stack already documents this hazard in net_core.c ("do not use pkt after that call") and caches iface before sending; the ICMPv6 callers did not. An unauthenticated remote attacker triggers the flaw simply by sending an ICMPv6 Echo Request (ping) or an IPv6 packet that elicits an ICMPv6 error (unknown next header, fragment reassembly timeout, destination unreachable), leading to denial of service via crash and potential memory corruption. Affected: Zephyr networking with CONFIG_NET_NATIVE_IPV6, roughly v4.2.0 through v4.4.0. The fix caches the interface pointer before sending and uses it for all statistics updates; the sibling commit 86e21665d46 fixes the identical bug in ICMPv4.
CVSS v3.1
Score 5.9medium
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
In Zephyr's networking stack, specifically in subsys/net/ip/icmpv6.c, the code reads the network interface from a net_pkt after the packet has been passed to net_try_send_data(). The send path may free the packet synchronously or asynchronously, causing net_pkt_iface() to dereference a freed packet. This leads to a use-after-free condition that can escalate to writing through an attacker-controllable pointer when per-interface statistics are enabled. The vulnerability can be triggered remotely without authentication by sending ICMPv6 Echo Requests or packets that generate ICMPv6 errors. The root cause is that the ICMPv6 handlers do not cache the interface pointer before sending, unlike the core stack. The fix involves caching the interface pointer before sending and using it for statistics updates. The affected versions are approximately Zephyr v4.2.0 through v4.4.0 with CONFIG_NET_NATIVE_IPV6. No official patch or remediation level is stated in the provided data.
Potential Impact
An unauthenticated remote attacker can cause a denial of service by crashing the system or potentially cause memory corruption by exploiting the use-after-free vulnerability in the ICMPv6 handling code. This impacts the availability and potentially the integrity of affected Zephyr systems configured with native IPv6 networking.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The described fix involves caching the interface pointer before sending packets to avoid use-after-free. Until an official fix is applied, consider disabling CONFIG_NET_NATIVE_IPV6 if feasible to mitigate exposure. Monitor vendor channels for an official patch or update.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- zephyr
- Date Reserved
- 2026-06-02T15:10:55.949Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a3165080b89be6888c91b23
Added to database: 06/16/2026, 15:00:24 UTC
Last enriched: 07/22/2026, 22:49:07 UTC
Last updated: 08/01/2026, 07:17:58 UTC
Views: 128
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.