Zephyr RTOS CVE-2026-7656

Exploitation requires the target to be a Zephyr device (≤ v4.4.0) running the IPv6 stack with Neighbor Discovery processing active, and the attacker must be able to deliver ICMPv6 ND packets to it - natively from an adjacent on-link position (AV:A), or potentially from off-link/remote since the bypassed Hop-Limit==255 guard normally blocks routed ND packets. The triggering condition is trivially met: the attacker simply sets the ICMPv6 code field to 0 (the standard, default value for every legitimate ND message), which forces the buggy predicate false and skips all validation - no special victim configuration, authentication (PR:N), or user interaction (UI:N) is needed. Forged-DNS impact additionally requires CONFIG_NET_IPV6_RA_RDNSS to be enabled on the victim; router/prefix/MTU/timer hijack and NS/NA neighbor-cache poisoning need no such option. Limiting factors: IPv4-only or IPv6-disabled builds are unaffected, and network-layer RA-Guard/ND-inspection or isolated trusted segments can prevent forged packets from reaching the device.

The CVSS 3.1 vector (AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H, base 8.1) reflects an unauthenticated, low-complexity attack from an adjacent (on-link) position with high integrity and availability impact and no confidentiality impact - consistent with neighbor-cache/router poisoning rather than direct data disclosure. The most important nuance is that the description explicitly states the bug bypasses the Hop-Limit==255 guard, meaning the AV:A scoping is conservative: off-link/remote attackers whose packets would normally be rejected may also succeed, so real-world reach could exceed the 'Adjacent' label - verify exposure assumptions accordingly. No EPSS score was supplied, the CVE is not KEV-listed, and no POC is referenced, so there is no public exploit identified at time of analysis; this is a credible, high-impact pre-auth network flaw but not currently evidenced as actively exploited. The 'Denial Of Service' tag understates impact - MITM and traffic redirection are also achievable. Practical priority is high for any internet- or untrusted-LAN-facing Zephyr IPv6 device, moderate for isolated/trusted segments.

An attacker on the same link (or, because the Hop-Limit==255 check is bypassed, potentially a remote attacker whose packet reaches the device) sends a forged Router Advertisement with ICMPv6 code 0 advertising the attacker as the default router and supplying a malicious RDNSS DNS server. The Zephyr victim accepts it without validating source link-local address or hop limit, reroutes its traffic and DNS through the attacker, enabling man-in-the-middle interception, redirection, or denial of service. No POC is currently public, and the low attack complexity (AC:L) with no required privileges or user interaction makes crafting such packets straightforward with standard IPv6 tooling.