The vulnerability exists in the function handle_ra_6co() within subsys/net/ip/ipv6_nbr.c of Zephyr. The 8-bit context_len field from the 6LoWPAN Context Option is not bounded to the RFC maximum of 128. When context_len is between 136 and 255, the calculation context_len / 8 results in values from 17 to 31, causing the subsequent memset to write beyond the fixed 16-byte context->prefix array. This results in an unbounded out-of-bounds zeroing of kernel memory. The flaw can be exploited by sending a crafted ICMPv6 Router Advertisement with a malicious 6CO option from any host on the same link, as the RA handler only validates the option length field before calling handle_ra_6co(). The impact is a reliable remote adjacent denial of service with integrity loss due to memory corruption. The vulnerability is present when CONFIG_NET_6LO_CONTEXT is enabled. The fix involves rejecting any context_len greater than 128 before performing length computations.

An unauthenticated attacker on the same local network link can cause a reliable denial of service by triggering a memory corruption through a crafted Router Advertisement packet. This leads to kernel memory being zeroed out beyond intended bounds, causing system faults and loss of integrity. There is no confidentiality impact reported. The attack vector is adjacent network (AV:A), requiring no privileges or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The vulnerability is fixed by rejecting context_len values greater than 128 before length computations. Until a patch is available, disabling CONFIG_NET_6LO_CONTEXT or filtering ICMPv6 Router Advertisements from untrusted local hosts may mitigate risk.