CVE-2026-10640: use-after-free in zephyrproject zephyr
Zephyr's IPv6 Neighbor Discovery send paths (net_ipv6_send_na, net_ipv6_send_ns, net_ipv6_send_rs in subsys/net/ip/ipv6_nbr.c) updated the per-interface ICMP-sent statistics by calling net_pkt_iface(pkt) after net_send_data(pkt) had already returned successfully. On the success path the network stack owns and releases the packet's reference (the L2/driver send unrefs it, e.g. ethernet_send -> net_pkt_unref), so for a freshly allocated packet with refcount 1 the net_pkt slab block can be freed before the statistics line runs (synchronously when no TX queue thread is configured, or via a concurrent TX thread otherwise). The subsequent net_pkt_iface(pkt) reads pkt->iface from the freed slab block, and with CONFIG_NET_STATISTICS_PER_INTERFACE enabled that loaded pointer is dereferenced to increment iface->stats.icmp.sent, a use-after-free (CWE-416). If the slab block was reallocated in the meantime the read/increment targets unrelated or attacker-influenced memory, yielding corrupted statistics, a fault/crash (denial of service), or potential limited memory corruption. The vulnerable Neighbor Advertisement path is reachable by any unauthenticated on-link node simply by sending ICMPv6 Neighbor Solicitations to a Zephyr node with native IPv6 enabled (handle_ns_input -> net_ipv6_send_na). Affected from v3.3.0 through v4.4.0; the fix uses the already-available iface argument instead of touching the sent packet. Configurations without per-interface statistics dereference only a global counter and are not affected by the memory-safety aspect.
AI Analysis
Technical Summary
In Zephyr's IPv6 Neighbor Discovery implementation, functions net_ipv6_send_na, net_ipv6_send_ns, and net_ipv6_send_rs update per-interface ICMP-sent statistics by calling net_pkt_iface(pkt) after net_send_data(pkt) has successfully returned. Since the network stack releases the packet reference upon successful send, the packet's memory can be freed before the statistics update occurs. Accessing pkt->iface after free leads to a use-after-free vulnerability (CWE-416). This can cause corrupted statistics, application faults, crashes (denial of service), or limited memory corruption if the freed memory is reallocated. The vulnerable code path is reachable by any unauthenticated on-link node sending ICMPv6 Neighbor Solicitations to a Zephyr node with native IPv6 enabled. The vulnerability affects Zephyr versions from 3.3.0 through 4.4.0. The fix replaces the use of the freed packet pointer with the already-available iface argument. Configurations without per-interface statistics, which use a global counter, are not affected by the memory safety issue.
Potential Impact
The vulnerability can lead to memory corruption or denial of service via application crashes when the freed packet memory is accessed. It does not impact confidentiality but can cause integrity issues in ICMP statistics and availability issues due to crashes. The vulnerability is exploitable by unauthenticated on-link attackers sending ICMPv6 Neighbor Solicitations to affected Zephyr nodes with IPv6 enabled.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The described fix involves using the iface argument instead of accessing the freed packet pointer. Until an official fix is available, disabling per-interface ICMP statistics (CONFIG_NET_STATISTICS_PER_INTERFACE) can mitigate the memory safety aspect, as configurations without this enabled use a global counter and are not affected. Monitor vendor channels for an official patch or update.
CVE-2026-10640: use-after-free in zephyrproject zephyr
Description
Zephyr's IPv6 Neighbor Discovery send paths (net_ipv6_send_na, net_ipv6_send_ns, net_ipv6_send_rs in subsys/net/ip/ipv6_nbr.c) updated the per-interface ICMP-sent statistics by calling net_pkt_iface(pkt) after net_send_data(pkt) had already returned successfully. On the success path the network stack owns and releases the packet's reference (the L2/driver send unrefs it, e.g. ethernet_send -> net_pkt_unref), so for a freshly allocated packet with refcount 1 the net_pkt slab block can be freed before the statistics line runs (synchronously when no TX queue thread is configured, or via a concurrent TX thread otherwise). The subsequent net_pkt_iface(pkt) reads pkt->iface from the freed slab block, and with CONFIG_NET_STATISTICS_PER_INTERFACE enabled that loaded pointer is dereferenced to increment iface->stats.icmp.sent, a use-after-free (CWE-416). If the slab block was reallocated in the meantime the read/increment targets unrelated or attacker-influenced memory, yielding corrupted statistics, a fault/crash (denial of service), or potential limited memory corruption. The vulnerable Neighbor Advertisement path is reachable by any unauthenticated on-link node simply by sending ICMPv6 Neighbor Solicitations to a Zephyr node with native IPv6 enabled (handle_ns_input -> net_ipv6_send_na). Affected from v3.3.0 through v4.4.0; the fix uses the already-available iface argument instead of touching the sent packet. Configurations without per-interface statistics dereference only a global counter and are not affected by the memory-safety aspect.
CVSS v3.1
Score 4.2medium
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
In Zephyr's IPv6 Neighbor Discovery implementation, functions net_ipv6_send_na, net_ipv6_send_ns, and net_ipv6_send_rs update per-interface ICMP-sent statistics by calling net_pkt_iface(pkt) after net_send_data(pkt) has successfully returned. Since the network stack releases the packet reference upon successful send, the packet's memory can be freed before the statistics update occurs. Accessing pkt->iface after free leads to a use-after-free vulnerability (CWE-416). This can cause corrupted statistics, application faults, crashes (denial of service), or limited memory corruption if the freed memory is reallocated. The vulnerable code path is reachable by any unauthenticated on-link node sending ICMPv6 Neighbor Solicitations to a Zephyr node with native IPv6 enabled. The vulnerability affects Zephyr versions from 3.3.0 through 4.4.0. The fix replaces the use of the freed packet pointer with the already-available iface argument. Configurations without per-interface statistics, which use a global counter, are not affected by the memory safety issue.
Potential Impact
The vulnerability can lead to memory corruption or denial of service via application crashes when the freed packet memory is accessed. It does not impact confidentiality but can cause integrity issues in ICMP statistics and availability issues due to crashes. The vulnerability is exploitable by unauthenticated on-link attackers sending ICMPv6 Neighbor Solicitations to affected Zephyr nodes with IPv6 enabled.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The described fix involves using the iface argument instead of accessing the freed packet pointer. Until an official fix is available, disabling per-interface ICMP statistics (CONFIG_NET_STATISTICS_PER_INTERFACE) can mitigate the memory safety aspect, as configurations without this enabled use a global counter and are not affected. Monitor vendor channels for an official patch or update.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- zephyr
- Date Reserved
- 2026-06-02T15:11:40.707Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a31650b0b89be6888c91fe6
Added to database: 06/16/2026, 15:00:27 UTC
Last enriched: 07/15/2026, 10:45:43 UTC
Last updated: 07/31/2026, 19:22:57 UTC
Views: 80
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.