Zephyr RTOS CVE-2026-12633

The Zephyr build must be compiled with CONFIG_NET_6LO_CONTEXT enabled - this is a non-default build-time option that must be explicitly selected; builds without it do not contain the vulnerable code path. The attacker must be on the same link as the target device: ICMPv6 Router Advertisements are link-scoped and not forwarded by routers, so internet-based remote exploitation is not possible. Within that link, no authentication is required (CVSS PR:N) and no user interaction is needed. The pre-fix RA option length validation accepts an option length field of 3, which must be set alongside the oversized context_len value; this is a trivial packet construction requirement, not a meaningful barrier. Limiting factors: restricted to layer-2 adjacency (same Ethernet segment, Wi-Fi network, or equivalent); dependent on a non-default build configuration; applicable only to Zephyr RTOS, primarily embedded and IoT targets.

The vendor-assigned CVSS 8.1 score (AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H) accurately characterizes the threat profile. The adjacent-network attack vector (AV:A) is a meaningful limiter: Router Advertisements are link-scoped and not forwarded by routers, confining exploitation to hosts on the same layer-2 segment. Within that scope, however, exploitation is low-complexity and requires no authentication, no user interaction, and only a single malformed packet, making it highly reliable once an attacker achieves link-local access. The zero confidentiality impact (C:N) is consistent with the description - the memset overwrites rather than leaks memory. No EPSS score was present in the input data, so probabilistic exploitation likelihood cannot be quantified from available signals. The vulnerability is not listed in the CISA KEV catalog and no public exploit code has been identified, though the public patch commit and security advisory describe the bug in sufficient detail to reconstruct the trigger condition. The non-default build flag CONFIG_NET_6LO_CONTEXT constrains the affected population to Zephyr builds that explicitly enable 6LoWPAN context support, which narrows real-world exposure further. For IoT and embedded deployments where Zephyr is common and devices may share a wireless link with untrusted peers, this should be treated as high priority.

An attacker who has gained access to the same network link as a Zephyr device - for example, via a shared Wi-Fi segment, a compromised IoT gateway, or physical access to the local network - sends a single crafted ICMPv6 Router Advertisement with a 6LoWPAN Context Option whose context_len field is set to a value between 136 and 255 and whose option length field is set to 3. The Zephyr kernel processes the packet through handle_ra_6co() without rejecting the oversized context_len, triggering the size_t underflow and an unbounded memset that corrupts contiguous kernel memory. The device crashes, causing a denial of service, with potential memory integrity corruption prior to the fault; no exploit code is publicly available, but the patch diff makes the trigger condition fully transparent.