The vulnerability exists in subsys/net/ip/ipv6_nbr.c within Zephyr's IPv6 neighbor-discovery implementation. The 8-bit context_len field from the 6LoWPAN Context Option in ICMPv6 Router Advertisements is not properly bounded to the RFC maximum of 128. When context_len is between 136 and 255, the calculation context_len / 8 results in a value between 17 and 31, causing an underflow in the memset length argument. This leads to an unbounded out-of-bounds write that zeroes kernel memory beyond the intended 16-byte context->prefix array. The flaw is exploitable by any unauthenticated host on the same link sending a crafted Router Advertisement. The vulnerability requires CONFIG_NET_6LO_CONTEXT to be enabled in the build. The impact is a reliable remote denial of service via memory corruption and integrity loss. The fix involves rejecting context_len values greater than 128 before performing the memset.

An unauthenticated attacker on the same local network can send a specially crafted Router Advertisement with a malicious 6LoWPAN Context Option to trigger an out-of-bounds memory write. This causes memory corruption leading to a denial of service by crashing the system. The integrity of kernel memory is compromised as the memset zeroes memory beyond the intended buffer. The vulnerability does not affect confidentiality or availability beyond denial of service. The attack vector is local network adjacent (AV:A), requires no privileges (PR:N), and no user interaction (UI:N).

A fix is available that rejects any context_len value greater than 128 before the length computation and memset operation. Users should upgrade Zephyr to version 4.4.2 or later where this vulnerability is patched. If upgrading is not immediately possible, ensure that CONFIG_NET_6LO_CONTEXT is disabled to avoid compiling the vulnerable code. No other mitigations are indicated by the vendor advisory.