EUVD-2026-37117Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain adjacent on-link network access
-
DeliverySend crafted ICMPv6 Neighbor Solicitation
-
Exploithandle_ns_input invokes net_ipv6_send_na
-
ExecutionPacket freed on successful send
-
PersistStale net_pkt_iface(pkt) dereferenced (UAF)
-
ImpactFault/crash causing denial of service
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that the target Zephyr node (versions 3.3.0-4.4.0) be built with native IPv6 enabled and reachable from an adjacent on-link node, and that CONFIG_NET_STATISTICS_PER_INTERFACE be enabled for the use-after-free/memory-safety impact (without it, only a benign global counter is touched). The trigger is sending ICMPv6 Neighbor Solicitations, which reach net_ipv6_send_na via handle_ns_input; no authentication or user interaction is needed (PR:N/UI:N). Limiting factors: the attacker must be on the same link (AV:A - not routable across the internet), and the freed-then-freshly-reallocated timing window is more deterministic when no TX queue thread is configured (synchronous unref) but becomes a race when a concurrent TX thread exists. Builds without per-interface statistics are not affected by the memory-safety aspect. |
| Impact | Signals are broadly consistent and point to a real-but-moderate priority. The CVSS 3.1 vector (AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H, score 7.1) reflects adjacent-network reach, no authentication, no user interaction, and a primarily availability impact - matching the description of an on-link unauthenticated attacker causing crashes. SSVC reinforces a measured stance: Exploitation 'none' (no observed exploitation), Automatable 'no', and Technical Impact 'partial', and it is not on the CISA KEV list. EPSS is low at 0.14% (4th percentile), consistent with a DoS-class embedded RTOS bug rather than a mass-exploited RCE. Importantly, the memory-safety aspect is conditional: only deployments with CONFIG_NET_STATISTICS_PER_INTERFACE enabled are affected; configurations using only a global counter dereference a valid global and are not subject to the UAF. The 'potential limited memory corruption' beyond DoS is speculative in the description (depends on slab reallocation timing/contents) and should not be treated as confirmed code execution. Net: prioritize patching on IPv6-enabled Zephyr devices with per-interface statistics, but this is not a high-urgency wormable issue. |
| Exploit ScenarioDerived | An attacker on the same link layer as a Zephyr device (e.g., the same Ethernet/Wi-Fi segment) sends crafted ICMPv6 Neighbor Solicitations to the target's IPv6 address. The handle_ns_input path invokes net_ipv6_send_na, which after sending reads the freed packet's interface pointer; on a device built with per-interface statistics, this use-after-free can fault and crash the node, producing a denial of service. No authentication or user interaction is required, though adjacent-network access is; no public exploit code is currently identified. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv3 – Jun 26, 2026
Denial of service (and potential limited memory corruption) in the Zephyr RTOS IPv6 networking stack (versions 3.3.0 through 4.4.0) stems from a use-after-free in the IPv6 Neighbor Discovery send paths, where per-interface ICMP statistics are updated by reading from a network packet after the stack has already freed it. Any unauthenticated on-link node can trigger the Neighbor Advertisement path simply by sending ICMPv6 Neighbor Solicitations to a Zephyr node with native IPv6 and CONFIG_NET_STATISTICS_PER_INTERFACE enabled, causing a freed slab block to be dereferenced. There is no public exploit identified at time of analysis and EPSS is low (0.14%, 4th percentile); a vendor patch is available, and impact is largely limited to crashes/DoS with only theoretical limited memory corruption.
Earlier versions of this analysis (2)
Use-after-free in Zephyr RTOS's IPv6 Neighbor Discovery code (subsys/net/ip/ipv6_nbr.c, versions 3.3.0 through 4.4.0) lets any unauthenticated on-link node trigger a denial of service by sending ICMPv6 Neighbor Solicitations to a Zephyr device with native IPv6 enabled. The send paths increment per-interface ICMP statistics by reading pkt->iface after net_send_data() already released the packet's last reference, so the freed slab block is dereferenced - causing crashes, corrupted statistics, or limited memory corruption. Only builds with CONFIG_NET_STATISTICS_PER_INTERFACE enabled are affected by the memory-safety bug; no public exploit identified at time of analysis (EPSS 0.14%, SSVC exploitation: none).
Use-after-free in Zephyr RTOS IPv6 Neighbor Discovery (v3.3.0-v4.4.0) exposes an on-link attacker to trigger memory corruption or a crash by sending ICMPv6 Neighbor Solicitations to any Zephyr node with native IPv6 and per-interface statistics enabled. The flaw exists in three NDP send paths - net_ipv6_send_na, net_ipv6_send_ns, and net_ipv6_send_rs - where statistics are updated via the already-freed packet after net_send_data() relinquishes ownership. No public exploit code exists and the vulnerability is not listed in CISA KEV, but the NA path is directly reachable from any adjacent unauthenticated node, making it an accessible trigger under the required configuration.
RemediationAI
Upgrade to Zephyr 4.5.0 or later, which incorporates the upstream fix (commit aaed8332a62b0490a2f3c2cbabe272f575068eaa) that replaces net_pkt_iface(pkt) with the already-available iface argument in net_ipv6_send_na, net_ipv6_send_ns, and net_ipv6_send_rs; see the advisory at https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-r74c-mr4m-7g9g. Because Zephyr is typically vendored into device firmware, downstream maintainers should cherry-pick the one-line-per-function commit into their pinned tree and rebuild/redeploy firmware. As a compensating control where firmware cannot be rebuilt immediately, disabling CONFIG_NET_STATISTICS_PER_INTERFACE removes the memory-safety impact (the global-counter path is not affected), at the cost of losing per-interface ICMP statistics; alternatively, restricting or filtering inbound ICMPv6 Neighbor Solicitations at the L2 segment or disabling native IPv6 where unused reduces reachability, with the trade-off of impaired IPv6 neighbor discovery functionality.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is Zephyr's IPv6 Neighbor Discovery implementation in subsys/net/ip/ipv6_nbr.c, specifically net_ipv6_send_na, net_ipv6_send_ns, and net_ipv6_send_rs. Zephyr manages network packets (net_pkt) using reference-counted slab-allocated blocks; on a successful net_send_data() call, the L2/driver send path (e.g. ethernet_send) owns and releases the packet's final reference via net_pkt_unref, freeing the slab block. The root cause (CWE-416, Use After Free) is that the statistics line called net_pkt_iface(pkt) after net_send_data() returned, reading the pkt->iface field from a slab block whose refcount may already have dropped to zero and been freed - synchronously when no dedicated TX queue thread is configured, or via a race with a concurrent TX thread otherwise. When CONFIG_NET_STATISTICS_PER_INTERFACE is enabled, that stale pointer is dereferenced to increment iface->stats.icmp.sent. The CPE cpe:2.3:a:zephyrproject:zephyr identifies the affected product. The fix is trivial and correct: use the already-available iface function argument instead of re-deriving it from the sent packet.
Know when Zephyr gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
On-link unauthenticated trigger via ICMPv6 (AV:A/PR:N/UI:N); primary impact is crash/DoS (A:H) with only marginal integrity from stat corruption (I:L) and no confidentiality (C:N).
Primary rating from Vendor (zephyr).
CVSS VectorNVD
Lifecycle Timeline
4DescriptionNVD
Zephyr's IPv6 Neighbor Discovery send paths (net_ipv6_send_na, net_ipv6_send_ns, net_ipv6_send_rs in subsys/net/ip/ipv6_nbr.c) updated the per-interface ICMP-sent statistics by calling net_pkt_iface(pkt) after net_send_data(pkt) had already returned successfully. On the success path the network stack owns and releases the packet's reference (the L2/driver send unrefs it, e.g. ethernet_send - net_pkt_unref), so for a freshly allocated packet with refcount 1 the net_pkt slab block can be freed before the statistics line runs (synchronously when no TX queue thread is configured, or via a concurrent TX thread otherwise).
The subsequent net_pkt_iface(pkt) reads pkt-iface from the freed slab block, and with CONFIG_NET_STATISTICS_PER_INTERFACE enabled that loaded pointer is dereferenced to increment iface-stats.icmp.sent, a use-after-free (CWE-416). If the slab block was reallocated in the meantime the read/increment targets unrelated or attacker-influenced memory, yielding corrupted statistics, a fault/crash (denial of service), or potential limited memory corruption.
The vulnerable Neighbor Advertisement path is reachable by any unauthenticated on-link node simply by sending ICMPv6 Neighbor Solicitations to a Zephyr node with native IPv6 enabled (handle_ns_input - net_ipv6_send_na).
Affected from v3.3.0 through v4.4.0; the fix uses the already-available iface argument instead of touching the sent packet. Configurations without per-interface statistics dereference only a global counter and are not affected by the memory-safety aspect.
Executive ViewAI
Zephyr RTOS-based IoT and edge devices (versions 3.3.0-4.4.0) face potential denial of service from any attacker on the local network segment, impacting device uptime and service continuity. While no public exploit has been identified at time of analysis, the vulnerability's ease of triggering and broad Zephyr deployment footprint create significant risk. Immediate patch deployment is required to protect critical connected systems.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Potential off-by-one buffer overflow vulnerability in the Zephyr fuse file system. Rated critical severity (CVSS 10.0),
An out-of-bounds write in the Zephyr RTOS DNS resolver (dns_unpack_name()) lets a crafted DNS response corrupt memory on
Possible variant of CVE-2021-3434 in function le_ecred_reconf_req. Rated critical severity (CVSS 9.8), this vulnerabilit
Unchecked user input length in /subsys/net/l2/wifi/wifi_shell.c can cause buffer overflows. Rated critical severity (CVS
Potential buffer overflow vulnerability in the Zephyr CAN bus subsystem. Rated critical severity (CVSS 9.8), this vulner
Integer Underflow in 6LoWPAN IPHC Header Uncompression in Zephyr. Rated critical severity (CVSS 9.8), this vulnerability
Buffer overflow in Zephyr USB DFU DNLOAD. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable
DOS: Incorrect 802154 Frame Validation for Omitted Source / Dest Addresses. Rated critical severity (CVSS 9.8), this vul
zephyr-rtos version 1.12.0 contains a NULL base pointer reference vulnerability in sys_ring_buf_put(), sys_ring_buf_get(
Potential buffer overflow vulnerabilities n the Zephyr Bluetooth subsystem. Rated critical severity (CVSS 9.6), this vul
The documentation specifies that the BT_GATT_PERM_READ_LESC and BT_GATT_PERM_WRITE_LESC defines for a Bluetooth characte
Potential buffer overflows in the Bluetooth subsystem due to asserts being disabled in /subsys/bluetooth/host/hci_core.c
Exploit-DB