Zephyr RTOS CVE-2026-12630

The target device must be running a Zephyr version between 2.0.0 and less than 4.4.2 with both IEEE 802.15.4 layer support (CONFIG_NET_L2_IEEE802154) and 6LoWPAN IPHC uncompression (CONFIG_NET_6LO) compiled and active - these are non-default features that must be explicitly enabled at build time. The attacker must be within radio range of the target's 802.15.4 interface (typically tens of meters for standard hardware, potentially further with directional antennas). No authentication, session establishment, or PAN association is required because the vulnerable code path (net_6lo_uncompress) is reached before any higher-layer filtering. The received IPHC word is consumed directly from the raw frame with no prior validation. Exploitation is limited to the adjacent radio domain - this is not remotely exploitable over the internet - and requires the attacker to know or discover that a target node is running a vulnerable Zephyr build with 6LoWPAN enabled.

The CVSS 3.1 vector (AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L, score 4.3) accurately reflects the threat model: exploitation requires physical or logical adjacency to the target's 802.15.4 radio channel, which meaningfully limits the attack surface compared to internet-reachable vulnerabilities. Confidentiality impact is correctly scored None - the out-of-bounds byte is consumed internally and not returned to the sender. Attack complexity is Low because the malformed frame requires only setting the DA nibble to 13, 14, or 15 - trivially constructable with any 802.15.4 radio and packet crafting tool. No EPSS data was provided; given the absence of KEV listing and the adjacency requirement, exploitation probability is expected to be low in broad scanning scenarios. The practical blast radius is bounded to devices running Zephyr with 6LoWPAN/IEEE 802.15.4 enabled, which is an embedded IoT niche rather than enterprise infrastructure. The denial-of-service impact on safety-critical or industrial IoT deployments may be disproportionate to the CVSS score - a device crash in a sensor mesh or medical IoT context carries operational risk beyond what a 4.3 score suggests. No public exploit code exists at time of analysis, and exploitation requires radio proximity, so the urgency is moderate for typical deployments.

An attacker with a software-defined radio or 802.15.4-capable device positions within radio range of a Zephyr-based IoT node (sensor, gateway, or embedded controller) running 6LoWPAN. They transmit a single crafted IEEE 802.15.4 frame containing a 6LoWPAN IPHC dispatch byte with the destination addressing nibble set to 13, 14, or 15, which are reserved values. The receiving Zephyr device reads past the end of da_inline_size_table, corrupts its computed header size, and crashes or enters an undefined state - no prior association, authentication, or interaction with the target is required. No public proof-of-concept has been identified, but the construction of such a frame is straightforward for anyone with basic 802.15.4 tooling.