CVE-2026-19577: bounds in zephyrproject zephyr

The vulnerability occurs in net_route_ipv6_packet() in Zephyr's IPv6 routing subsystem, where the next-hop's link-layer address is resolved without verifying if the neighbor cache entry has a valid linked address. An unresolved neighbor entry uses an index of 0xff, which leads net_nbr_get_lladdr() to return a pointer roughly 2.5 KB past the end of the neighbor link-layer address array. This out-of-bounds pointer bypasses null checks, resulting in an out-of-bounds read. When CONFIG_ASSERT is enabled, this triggers an assertion failure causing a device panic (remote denial of service). Without assertions, the out-of-bounds data is used in a memcmp() and may leak up to 8 bytes of unrelated static RAM in outgoing packets. The flaw can be triggered by an unauthenticated attacker on the same link by causing unresolved neighbor entries through spoofed traffic or malformed Router Advertisements. The vulnerability affects Zephyr versions >=1.8.0 and <4.5.0.

An unauthenticated attacker on the same network link can cause a remote denial of service by triggering a device panic via an assertion failure. Alternatively, with assertions disabled, the attacker can cause limited information disclosure by leaking up to 8 bytes of static RAM in transmitted packets. There is no impact on data integrity or elevated privileges. The vulnerability does not allow out-of-bounds writes or attacker-controlled memory corruption.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, mitigating this vulnerability may require disabling IPv6 routing features or neighbor cache functionality if feasible, or restricting network access to trusted devices to prevent attacker proximity. Monitor vendor communications for official fixes.