Zephyr RTOS EUVD-2026-37116

Exploitation requires that the Zephyr device is compiled with CONFIG_NET_STATISTICS_ICMP=y - the build-time flag that enables the vulnerable net_stats_update_icmp_sent() call after packet transmission. The attack surface is the standard ICMPv4 echo (ping) handler, reachable by any remote host with network-layer access to the device - no authentication, session state, or credentials are required (CVSS PR:N). The severity of the write-through-pointer impact is further conditioned on CONFIG_NET_STATISTICS_PER_INTERFACE=y also being set; without it, only the use-after-free read occurs. The critical limiting factor is a timing race: the freed-memory access only manifests if the TX path asynchronously releases the packet before the stats line executes, making exploitation probabilistic and dependent on scheduler behavior and system load. The device must be directly reachable via ICMP - i.e., not behind a firewall or ACL that drops inbound echo requests. Affected versions span v1.14 through v4.4.0.

The CVSS 3.1 score of 4.8 (Medium) with vector AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L accurately captures the threat profile: the attack is network-reachable via a simple ping with no credentials, but exploitation is gated on winning a timing race between the TX thread freeing the packet and the stats update executing (AC:H), making outcomes probabilistic rather than deterministic. No EPSS score was provided in the available intelligence, and this CVE is not listed in CISA KEV, with no public exploit code identified - signals that align with a niche, race-condition-dependent flaw in an embedded OS. Despite the moderate CVSS score, the real-world risk warrants attention in embedded/IoT contexts: Zephyr nodes are often long-lived and infrequently patched, ICMP is rarely filtered at the perimeter of sensor networks, and a repeated ping flood meaningfully increases the probability of winning the race. The worst-case outcome is a remotely triggerable device crash (DoS), which is operationally significant for safety-critical or always-on IoT applications. The absence of confidentiality impact and the probabilistic nature of the race are genuine mitigating factors. This is not a 'high-CVSS-but-low-risk' situation in reverse - the moderate CVSS score here is an honest reflection of a real but constrained threat.

An attacker with network access to a Zephyr v1.14-v4.4.0 device (such as an IoT sensor, industrial controller, or embedded gateway built with CONFIG_NET_STATISTICS_ICMP=y) floods the device with ICMP echo requests. Under favorable timing - when the TX thread frees the reply packet before the net_stats_update_icmp_sent() call executes - net_pkt_iface(reply) reads from freed slab memory; if that memory slot has been reallocated, CONFIG_NET_STATISTICS_PER_INTERFACE causes a write through a wild pointer, most likely corrupting interface statistics or triggering a kernel panic. No public exploit code has been identified, and the timing race makes each attempt non-deterministic, but volume-based flooding substantially increases the probability of triggering the race.