Zephyr RTOS CVE-2026-10638

The target must run Zephyr RTOS v4.2.0-v4.4.0 compiled with CONFIG_NET_NATIVE_IPV6=y. The vulnerability is triggered by receiving any ICMPv6 Echo Request (ping6) or any IPv6 packet that causes Zephyr to generate an ICMPv6 error message - specifically: a packet with an unknown next header type, a fragment reassembly timeout condition, or a destination unreachable condition. No authentication is required (CVSS PR:N confirmed). The most reliable exploitation path, eliminating the race condition, requires CONFIG_NET_TC_TX_COUNT == 0 (no TX queue, synchronous free in RX thread). The write-through memory corruption escalation additionally requires CONFIG_NET_STATISTICS_PER_INTERFACE=y. Limiting factors: the attacker must have IPv6 network reachability to the device; IPv4-only builds are not vulnerable to this CVE; devices with CONFIG_NET_TC_TX_COUNT > 0 retain a timing-dependent race that raises practical exploitation complexity.

The CVSS 3.1 score of 5.9 (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) captures network reachability and unauthenticated access, but AC:H reflects a race condition that is not uniformly applicable. For deployments with CONFIG_NET_TC_TX_COUNT == 0, the free occurs synchronously in the RX thread, eliminating the race entirely and making the UAF deterministic - real-world exploitation difficulty for those configurations is significantly lower than AC:H implies, and the effective risk is closer to a 7.5 (AV:N/AC:L) scenario. The CVSS vector records I:N, but the description explicitly states that CONFIG_NET_STATISTICS_PER_INTERFACE enables a write through an attacker-influenced stale pointer, which is a material integrity impact not reflected in the published score; this represents a meaningful discrepancy. EPSS data was not provided in source intelligence. The vulnerability is not in the CISA KEV catalog and no public exploit code has been identified at time of analysis. For embedded and IoT deployments running Zephyr - such as industrial control systems, medical devices, or connected embedded platforms - even a remote crash carries high operational consequence given the absence of hot-patching capabilities. The availability of the triggering primitive (a standard ICMPv6 ping) lowers the bar for denial-of-service attacks significantly.

An attacker with network reachability to a Zephyr-based embedded device's IPv6 address sends a standard ICMPv6 Echo Request (ping6); on a device with no TX queue (CONFIG_NET_TC_TX_COUNT == 0), the Zephyr ICMPv6 handler constructs a reply, passes the original packet to net_try_send_data(), and the memory slab is freed synchronously before control returns to the statistics update code, which then dereferences the freed net_pkt. If CONFIG_NET_STATISTICS_PER_INTERFACE is enabled, the stale net_if * pointer is written through, potentially corrupting adjacent memory structures and crashing the network stack or enabling further exploitation. No public proof-of-concept code has been identified at time of analysis, but the trigger requires only a standard ICMPv6 ping available in any Linux or Windows host.