CVE-2026-10637: Zephyr RTOS IPv6 MLD DOS Vulnerability

CVE-2026-10637 Overview

CVE-2026-10637 is a use-after-free vulnerability [CWE-416] in the Zephyr RTOS networking stack, specifically in the IPv6 Multicast Listener Discovery (MLD) implementation at subsys/net/ip/ipv6_mld.c. The mld_send() function accesses the net_pkt structure after net_send_data() has transferred ownership of the packet to the L2 driver. An unauthenticated attacker on the local link can trigger the flaw by sending a crafted MLDv2 General Query. The result is a remotely triggerable denial of service of the networking stack, with a narrow possibility of memory corruption when CONFIG_NET_STATISTICS_PER_INTERFACE is enabled.

Critical Impact
An adjacent network attacker can crash the Zephyr networking stack on affected devices without authentication, with limited potential for memory corruption affecting interface statistics writes.

Affected Products

Zephyr RTOS networking subsystem (subsys/net/ip/ipv6_mld.c)
Devices built with IPv6 and MLD support enabled
Builds with CONFIG_NET_STATISTICS_PER_INTERFACE enabled (expanded impact)

Discovery Timeline

2026-06-16 - CVE-2026-10637 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-10637

Vulnerability Analysis

The Zephyr network stack defines an ownership contract documented in include/zephyr/net/net_core.h and reinforced by the explicit warning in subsys/net/ip/net_core.c:453-460: callers must not use pkt after a successful net_send_data(). On success, ownership transfers to the L2 driver, which unreferences the packet and returns it to its k_mem_slab. For Ethernet, this occurs in ethernet_send() at subsys/net/l2/ethernet/ethernet.c:790.

Despite this contract, mld_send() reads net_pkt_iface(pkt) after net_send_data(pkt) returns. This dereferences a freed object. The recovered interface pointer is subsequently incremented through the per-interface statistics path using UPDATE_STAT/SET_STAT macros from net_stats.h.

Root Cause

The root cause is a violation of the network packet ownership contract. The mld_send() function retains and uses a stale net_pkt reference after relinquishing ownership through net_send_data(). The sibling IPv4/IGMP implementation in igmp_send() already followed the correct pattern of caching the interface in a local variable before sending.

Attack Vector

The path is reachable remotely on the local link without authentication. handle_mld_query(), registered for NET_ICMPV6_MLD_QUERY, responds to a valid MLDv2 General Query with an unspecified multicast address and hop limit of 1. This invokes send_mld_report() and then mld_send(), triggering the use-after-free.

If the freed slab slot is concurrently reallocated, pkt->iface may read back as NULL, producing a null-pointer dereference and crash. Alternatively, it may read back as a stale or garbage pointer, causing the statistics increment to perform a stray write and corrupt memory.

// Vulnerable pattern (described in advisory)
// net_send_data(pkt);              // ownership transferred, pkt freed on success
// net_pkt_iface(pkt) -> use-after-free read
// UPDATE_STAT(iface, ...) -> dereference + increment of stale pointer
//
// Fixed pattern (per commit 3159c53e)
// iface = net_pkt_iface(pkt);      // cache before send
// net_send_data(pkt);
// UPDATE_STAT(iface, ...);         // no further access to pkt

Detection Methods for CVE-2026-10637

Indicators of Compromise

Unexpected crashes or resets of Zephyr-based devices coinciding with receipt of IPv6 multicast traffic
Inbound ICMPv6 type 130 (MLDv2 General Query) packets from untrusted local-link sources
MLD queries with hop limit 1 and an unspecified multicast address arriving at embedded devices
Anomalous values or jumps in per-interface network statistics counters

Detection Strategies

Monitor link-local IPv6 traffic for malformed or repeated MLDv2 General Queries targeting embedded endpoints
Inspect kernel/RTOS panic logs for faults originating in mld_send or the statistics update path
Audit firmware builds to identify whether MLD and CONFIG_NET_STATISTICS_PER_INTERFACE are enabled
Correlate device reboot telemetry with IPv6 multicast activity on the same broadcast domain

Monitoring Recommendations

Enable ICMPv6 logging on upstream switches and routers to capture MLD query sources
Track device uptime and crash dumps from fleets of Zephyr-based devices for clustered failures
Alert on hosts emitting MLD queries that are not designated multicast routers
Baseline per-interface statistics and alert on discontinuities indicative of memory corruption

How to Mitigate CVE-2026-10637

Immediate Actions Required

Apply the upstream fix from Zephyr commit 3159c53e to all affected firmware images
Rebuild and redeploy device firmware to fleets running vulnerable Zephyr networking code
Restrict untrusted devices from sharing local-link segments with vulnerable embedded endpoints
Review whether IPv6 and MLD are required; disable them in builds where they are not used

Patch Information

The fix is published in the Zephyr project. See the Zephyr Security Advisory GHSA-m23w-34pp-4h92 and the upstream commit 3159c53e. The corrected pattern caches the interface pointer in a local variable before calling net_send_data() and no longer touches the packet afterward, matching the existing igmp_send() implementation.

Workarounds

Disable CONFIG_NET_IPV6_MLD in the Kconfig for builds that do not require MLD
Disable CONFIG_NET_STATISTICS_PER_INTERFACE to reduce exploitability to denial of service only
Apply MLD snooping and filtering at the network layer to drop untrusted MLDv2 General Queries
Segment Zephyr devices onto dedicated VLANs with strict ICMPv6 ingress controls

bash

# Example Kconfig adjustments for affected builds
CONFIG_NET_IPV6_MLD=n
CONFIG_NET_STATISTICS_PER_INTERFACE=n