CVE-2026-10636 Overview
CVE-2026-10636 is a use-after-free vulnerability [CWE-416] in the Zephyr real-time operating system's IPv4 Internet Group Management Protocol (IGMP) implementation. The flaw resides in igmp_send() within subsys/net/ip/igmp.c, which reads the network interface from a packet after the packet has been handed to net_send_data(). On the successful-send path, the packet's last reference may already have been released, returning the net_pkt slab block to its free list. The subsequent net_pkt_iface(pkt) call then dereferences freed memory. The vulnerability was introduced with IGMPv2 support and affects Zephyr releases from v2.6.0 through v4.4.0.
Critical Impact
Unauthenticated attackers can trigger the use-after-free remotely by sending crafted IPv4 IGMP membership queries to multicast address 224.0.0.1, leading to undefined behavior or denial of service.
Affected Products
- Zephyr RTOS v2.6.0 through v4.4.0
- IPv4 IGMP subsystem (subsys/net/ip/igmp.c)
- Devices built with default NET_TC_TX_COUNT=0 immediate-transmit configuration
Discovery Timeline
- 2026-06-16 - CVE-2026-10636 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2026-10636
Vulnerability Analysis
The vulnerability stems from improper lifetime management of a net_pkt structure in Zephyr's IGMP send path. The function igmp_send() calls net_send_data(pkt) to transmit an IGMP report, then accesses net_pkt_iface(pkt) to update per-interface statistics when CONFIG_NET_STATISTICS_PER_INTERFACE is enabled. By the time the statistics access executes, the L2 driver or the network stack's TX handling may have already released the final reference to the packet. In the default NET_TC_TX_COUNT=0 configuration, transmission happens synchronously on the caller's thread, making the release deterministic on the successful-send path.
The dereference of a freed net_pkt slab block produces a use-after-free read. When CONFIG_NET_STATISTICS_PER_INTERFACE is set, the dangling interface pointer extracted from the freed packet is itself dereferenced for a statistics-counter write, compounding the issue. The analogous IPv6 Multicast Listener Discovery (MLD) path in mld_send() within subsys/net/ip/ipv6_mld.c retains the same unfixed pattern.
Root Cause
The root cause is reading object state through a pointer whose ownership has already been transferred. igmp_send() assumes the packet remains valid after net_send_data() returns, but the Zephyr networking stack treats the call as a handoff that may release the slab block immediately.
Attack Vector
The IGMP send path is reachable without authentication from inbound IPv4 IGMP membership queries addressed to 224.0.0.1. The processing chain net_ipv4_igmp_input → send_igmp_report / send_igmp_v3_report → igmp_send exposes the vulnerable code to any host on the local network segment. Local multicast join, leave, and rejoin operations reach the same path. Realistic impact is undefined behavior and denial of service through sporadic crashes or statistics corruption. A controllable memory write would require the asynchronous TX path combined with concurrent slab reuse.
Detection Methods for CVE-2026-10636
Indicators of Compromise
- Unexpected restarts or watchdog resets on Zephyr-based devices following bursts of inbound IGMP traffic to 224.0.0.1
- Corrupted or implausible values in per-interface network statistics counters
- Crash logs referencing igmp_send, net_pkt_iface, or net_send_data in the call stack
Detection Strategies
- Inspect deployed firmware for Zephyr versions between v2.6.0 and v4.4.0 inclusive, and verify whether CONFIG_NET_STATISTICS_PER_INTERFACE is enabled
- Audit network captures on segments containing Zephyr devices for anomalous volumes of IGMP membership queries targeting 224.0.0.1
- Enable address sanitizer or equivalent memory diagnostics during firmware testing to surface use-after-free reads in igmp_send()
Monitoring Recommendations
- Monitor Zephyr device telemetry for crash dumps and panic events correlated with multicast network activity
- Aggregate device uptime metrics in a centralized log platform and alert on regressions across IGMP-capable fleets
- Track upstream switch IGMP querier traffic patterns to detect abnormal query rates targeting embedded subnets
How to Mitigate CVE-2026-10636
Immediate Actions Required
- Inventory all Zephyr-based devices and identify firmware images built on versions v2.6.0 through v4.4.0
- Apply the upstream fix that caches the interface pointer before calling net_send_data(), as committed in Zephyr commit 0223e5e3
- Review the analogous IPv6 MLD send path in subsys/net/ip/ipv6_mld.c and apply equivalent caching, as the pattern remains unfixed there
Patch Information
The fix caches net_pkt_iface(pkt) into a local variable before invoking net_send_data(pkt), eliminating the post-send dereference. Refer to the GitHub Security Advisory GHSA-fj6q-975v-65c9 for upstream guidance and the commit applying the fix.
Workarounds
- Disable CONFIG_NET_STATISTICS_PER_INTERFACE in Zephyr build configuration to remove the dangling interface pointer write, reducing the impact to a use-after-free read only
- Restrict IGMP traffic at upstream switches using IGMP snooping policies that limit untrusted hosts from issuing membership queries
- Segment Zephyr devices onto isolated VLANs where only trusted multicast routers can act as IGMP queriers
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
