CVE-2026-10638 Overview
CVE-2026-10638 is a use-after-free vulnerability [CWE-416] in the Zephyr RTOS networking stack, specifically in subsys/net/ip/icmpv6.c. The flaw exists in icmpv6_handle_echo_request() and net_icmpv6_send_error(), where the code reads the network interface from a net_pkt structure after that packet has been handed off to net_try_send_data(). The send path may free the packet back to its memory slab before the post-send statistics update executes, resulting in a dereference of freed memory. An unauthenticated remote attacker can trigger the condition by sending a single ICMPv6 Echo Request or an IPv6 packet that elicits an ICMPv6 error response.
Critical Impact
Remote unauthenticated attackers can cause denial of service through crashes and potentially achieve memory corruption against Zephyr devices with CONFIG_NET_NATIVE_IPV6 enabled.
Affected Products
- Zephyr RTOS networking stack with CONFIG_NET_NATIVE_IPV6 enabled
- Zephyr versions approximately v4.2.0 through v4.4.0
- Deployments with CONFIG_NET_STATISTICS_PER_INTERFACE enabled face elevated risk of memory corruption
Discovery Timeline
- 2026-06-16 - CVE-2026-10638 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2026-10638
Vulnerability Analysis
The vulnerability resides in two ICMPv6 handler functions inside subsys/net/ip/icmpv6.c. After calling net_try_send_data() to dispatch a reply or error packet, the code invokes net_pkt_iface(reply) or net_pkt_iface(pkt) on the just-sent packet to update statistics counters. By that point, the packet has already been unreferenced through the send path net_try_send_data → net_if_tx, and the underlying net_pkt structure may have been returned to its memory slab.
When CONFIG_NET_TC_TX_COUNT == 0, the free occurs synchronously on the RX thread before the function returns. Otherwise, the driver or L2 layer may free it asynchronously. With CONFIG_NET_STATISTICS_PER_INTERFACE enabled, the stale iface pointer is further dereferenced and written through via iface->stats.icmp.sent++, escalating the use-after-free read into a write through an attacker-influenceable pointer.
Root Cause
The Zephyr core stack already documents this hazard in net_core.c with the explicit note "do not use pkt after that call" and correctly caches the interface pointer before sending. The ICMPv6 callers failed to adopt this pattern. The sibling commit 86e21665d46 addresses the identical bug in the ICMPv4 stack.
Attack Vector
An unauthenticated remote attacker on the network can trigger the vulnerability with a single crafted packet. Valid triggers include an ICMPv6 Echo Request (ping) or any IPv6 packet that elicits an ICMPv6 error response, such as an unknown next header, a fragment reassembly timeout, or a destination unreachable condition. No authentication or user interaction is required.
{
struct net_pkt *reply = NULL;
struct net_ipv6_hdr *ip_hdr = hdr->ipv6;
+ struct net_if *iface = net_pkt_iface(pkt);
struct net_in6_addr req_src, req_dst;
const struct net_in6_addr *src;
struct net_pkt_cursor backup;
Source: Zephyr Project commit 09c8578c66b517c5165cde53332ed5d8d8ef2cfc. The patch caches net_pkt_iface(pkt) into a local iface variable before the send call, ensuring all subsequent statistics updates use the cached pointer rather than dereferencing the freed packet.
Detection Methods for CVE-2026-10638
Indicators of Compromise
- Unexpected device reboots or kernel faults on Zephyr devices following inbound ICMPv6 traffic
- Crash logs referencing icmpv6_handle_echo_request or net_icmpv6_send_error in the call stack
- Anomalous ICMPv6 traffic patterns directed at embedded devices, particularly Echo Requests or packets crafted to elicit ICMPv6 errors
Detection Strategies
- Inventory firmware builds to identify Zephyr versions between v4.2.0 and v4.4.0 with CONFIG_NET_NATIVE_IPV6 enabled
- Capture and inspect ICMPv6 traffic at network boundaries for malformed packets, unknown next headers, and fragmentation anomalies targeting embedded endpoints
- Correlate device crash telemetry with timestamps of inbound ICMPv6 traffic
Monitoring Recommendations
- Enable ICMPv6 flow logging on network infrastructure adjacent to IoT and embedded devices
- Monitor crash-dump collection systems for use-after-free signatures originating from the networking subsystem
- Alert on sustained ICMPv6 Echo Request volume against single Zephyr endpoints
How to Mitigate CVE-2026-10638
Immediate Actions Required
- Apply the upstream Zephyr patch from commit 09c8578c66b517c5165cde53332ed5d8d8ef2cfc and rebuild affected firmware images
- Identify all deployed devices running Zephyr v4.2.0 through v4.4.0 with native IPv6 enabled
- Restrict ICMPv6 ingress to affected devices at the network perimeter until firmware updates are deployed
Patch Information
The fix caches the interface pointer before sending and uses the cached value for all post-send statistics updates. The patch is available in the Zephyr Project commit 09c8578c66b517c5165cde53332ed5d8d8ef2cfc and documented in the Zephyr GitHub Security Advisory GHSA-m92g-94xv-wvw2.
Workarounds
- Disable CONFIG_NET_STATISTICS_PER_INTERFACE to reduce the impact from a write-through-freed-pointer to a read-only use-after-free, lowering memory corruption risk
- Filter inbound ICMPv6 Echo Requests and error-eliciting IPv6 packets at upstream gateways where operational requirements permit
- Where IPv6 is not required, disable CONFIG_NET_NATIVE_IPV6 in the Zephyr build configuration
# Configuration example: disable per-interface statistics in prj.conf
CONFIG_NET_STATISTICS_PER_INTERFACE=n
# Or disable native IPv6 entirely if not required
CONFIG_NET_NATIVE_IPV6=n
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
