Zephyr RTOS CVE-2026-10636

Remote trigger path: IPv4 IGMP must be enabled on the target interface (the default for any Zephyr device with multicast-capable networking); an attacker must be able to send IPv4 multicast packets to 224.0.0.1 on the same network segment (IGMP is link-local by default and not routed across subnets without a multicast router). Local trigger path: the vulnerability is also reachable via local multicast join, leave, or rejoin API calls, requiring local process execution. The most severe impact (a write to freed memory through the stats pointer) additionally requires CONFIG_NET_STATISTICS_PER_INTERFACE to be enabled in the build AND the asynchronous TX path (CONFIG_NET_TC_TX_COUNT > 0, a non-default setting); the default synchronous TX configuration (CONFIG_NET_TC_TX_COUNT=0) limits impact to a read of freed memory with a resulting sporadic undefined behavior crash. Exploitation is therefore bounded by network adjacency for the remote path, and the controllable-write scenario is further gated on a non-default build-time configuration.

The NVD CVSS 3.1 score of 3.7 (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L) correctly captures this as a low-severity, high-complexity vulnerability. The AC:H rating reflects the race condition dependency: in the default synchronous TX configuration the freed slab block is typically reused or corrupted only intermittently, making reproducible crashes difficult and controlled writes extremely unlikely. The network attack vector is accurate - IGMP membership queries to 224.0.0.1 reach igmp_send() without authentication. No EPSS score was provided in the input data, so exploitation probability cannot be independently quantified. The vulnerability is not listed in CISA KEV, and no public proof-of-concept exploit has been identified. Real-world risk is primarily sporadic crash or statistics corruption on embedded IoT and RTOS devices; a controlled write (which could theoretically elevate severity) requires the asynchronous TX path (CONFIG_NET_TC_TX_COUNT > 0) combined with precise concurrent slab reuse timing, making it impractical under most deployment conditions. The residual risk for defenders is the unpatched MLD analogue and the broad version range (v2.6.0-v4.4.0) covering all Zephyr releases over approximately four years.

An attacker on the same IPv4 multicast domain sends a crafted IGMP General Membership Query addressed to 224.0.0.1, which causes the Zephyr network stack to invoke net_ipv4_igmp_input and then igmp_send() to generate a membership report. In the default synchronous TX configuration, net_send_data() releases the packet's last reference before returning, and the subsequent net_pkt_iface(pkt) call reads the freed slab block, producing undefined behavior that manifests as a sporadic crash or memory corruption of the statistics counters. No public proof-of-concept exploit exists; achieving a reliable, controlled write would additionally require operating under the asynchronous TX configuration and timing a concurrent slab allocation to overlap with the freed packet.