CVE-2026-10640

Zephyr's IPv6 Neighbor Discovery send paths (net_ipv6_send_na, net_ipv6_send_ns, net_ipv6_send_rs in subsys/net/ip/ipv6_nbr.c) updated the per-interface ICMP-sent statistics by calling net_pkt_iface(pkt) after net_send_data(pkt) had already returned successfully. On the success path the network stack owns and releases the packet's reference (the L2/driver send unrefs it, e.g. ethernet_send -> net_pkt_unref), so for a freshly allocated packet with refcount 1 the net_pkt slab block can be freed before the statistics line runs (synchronously when no TX queue thread is configured, or via a concurrent TX thread otherwise). The subsequent net_pkt_iface(pkt) reads pkt->iface from the freed slab block, and with CONFIG_NET_STATISTICS_PER_INTERFACE enabled that loaded pointer is dereferenced to increment iface->stats.icmp.sent, a use-after-free (CWE-416). If the slab block was reallocated in the meantime the read/increment targets unrelated or attacker-influenced memory, yielding corrupted statistics, a fault/crash (denial of service), or potential limited memory corruption. The vulnerable Neighbor Advertisement path is reachable by any unauthenticated on-link node simply by sending ICMPv6 Neighbor Solicitations to a Zephyr node with native IPv6 enabled (handle_ns_input -> net_ipv6_send_na). Affected from v3.3.0 through v4.4.0; the fix uses the already-available iface argument instead of touching the sent packet. Configurations without per-interface statistics dereference only a global counter and are not affected by the memory-safety aspect.

• CWE-416

• https://github.com/zephyrproject-rtos/zephyr/commit/aaed8332a62b0490a2f3c2cbabe272f575068eaaPatch
• https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-r74c-mr4m-7g9gExploit, Vendor Advisory

Published

Jun 16, 2026

Last Modified

Jul 14, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-10635On Xtensa targets with CONFIG_USERSPACE and CONFIG_XTENSA_MM…6.3
• CVE-2026-10636In Zephyr's IPv4 IGMP implementation, igmp_send() in subsys/…3.7
• CVE-2026-10637subsys/net/ip/ipv6_mld.c:mld_send() read the packet interfac…7.1
• CVE-2026-10638subsys/net/ip/icmpv6.c reads the network interface from a ne…7.5
• CVE-2026-10639In Zephyr's native IPv4 stack, icmpv4_handle_echo_request() …4.8
• CVE-2026-1064A vulnerability was found in bastillion-io Bastillion up to …4.7
• CVE-2026-10641Zephyr's Bluetooth Classic Hands-Free Profile (HFP) Hands-Fr…7.1
• CVE-2026-10642The Zephyr PL011 UART driver (drivers/serial/uart_pl011.c) c…4.6
• CVE-2026-10643Zephyr's IP socket recvmsg() implementation (subsys/net/lib/…7.8
• CVE-2026-10644The Microchip SERCOM-G1 UART driver (drivers/serial/uart_mch…3.1
• CVE-2026-10645The Zephyr ext2 filesystem driver (subsys/fs/ext2) trusted t…5.5
• CVE-2026-10646Zephyr's BSD-sockets getaddrinfo() implementation (subsys/ne…7.4