CVE-2026-10639: Zephyr RTOS Use-After-Free Vulnerability

CVE-2026-10639 Overview

CVE-2026-10639 is a use-after-free vulnerability [CWE-416] in the Zephyr real-time operating system (RTOS) native IPv4 stack. The flaw resides in icmpv4_handle_echo_request() within subsys/net/ip/icmpv4.c. After the function passes an echo-reply packet to net_try_send_data(), it calls net_stats_update_icmp_sent(net_pkt_iface(reply)) on the same packet. The TX path may have already unreferenced the packet to refcount zero and returned its struct net_pkt to the slab allocator. The post-send dereference therefore reads from freed memory. Any unauthenticated remote host that can ping the device reaches this code path when CONFIG_NET_STATISTICS_ICMP is enabled.

Critical Impact
An unauthenticated remote attacker can trigger a use-after-free read, and potentially a wild-pointer write, by sending ICMPv4 echo requests, leading to corrupted statistics or denial of service.

Affected Products

Zephyr RTOS v1.14 (where the defect was introduced in 2019)
Zephyr RTOS versions through v4.4.0
Zephyr-based embedded devices built with CONFIG_NET_STATISTICS_ICMP enabled

Discovery Timeline

2026-06-16 - CVE-2026-10639 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-10639

Vulnerability Analysis

The vulnerability stems from a lifetime contract violation in Zephyr's IPv4 ICMP echo-reply handling. icmpv4_handle_echo_request() constructs a reply packet and hands it to net_try_send_data(). That call transfers ownership of the packet to the TX path, which routes through net_if_try_queue_tx, net_if_tx, and the L2 driver send routine, or via the asynchronous net_if_tx_thread. Any of those code paths may invoke net_pkt_unref and k_mem_slab_free, returning the struct net_pkt to its memory slab.

The Zephyr net_core.c documentation explicitly warns that after net_try_send_data() returns, "the pkt might contain garbage already ... do not use pkt after that call". Despite this contract, the original code reads net_pkt_iface(reply) after the send. The companion call in net_icmpv4_send_error() is not vulnerable because it reads net_pkt_iface(orig) from the caller-owned received packet, which remains alive.

Root Cause

The root cause is a violation of object lifetime rules. The reply packet is dereferenced after ownership transfer to the TX subsystem. When CONFIG_NET_STATISTICS_PER_INTERFACE is set, the stats macro additionally increments a counter through the interface pointer obtained from the freed packet. That write occurs through a stale or recycled-slot pointer, producing a probabilistic wild-pointer write.

Attack Vector

The path is reachable by any remote host that can send an IPv4 ICMP echo request to the device. The flow is net_icmpv4_input → net_icmp_call_ipv4_handlers → icmpv4_handle_echo_request. No authentication or user interaction is required. Reliable exploitation depends on a timing race between the TX path completing the unref and the post-send stats line executing.

 {
 	struct net_pkt *reply = NULL;
 	struct net_ipv4_hdr *ip_hdr = hdr->ipv4;
+	struct net_if *iface = net_pkt_iface(pkt);
 	struct net_in_addr req_src, req_dst;
 	const struct net_in_addr *src;
 	struct net_pkt_cursor backup;
// Source: https://github.com/zephyrproject-rtos/zephyr/commit/86e21665d4641f304dc3895bfb03b8f89db83291

The fix caches the interface pointer from the live received packet pkt before sending and uses that cached iface value for the post-send stats update.

Detection Methods for CVE-2026-10639

Indicators of Compromise

Unexpected device reboots or crashes correlated with bursts of inbound ICMPv4 echo requests.
Corrupted or implausible values in per-interface ICMP statistics counters.
Network stack faults or memory access exceptions in Zephyr logs referencing icmpv4 or net_pkt.

Detection Strategies

Inventory firmware images for Zephyr versions between v1.14 and v4.4.0 with CONFIG_NET_STATISTICS_ICMP enabled.
Inspect crash dumps from Zephyr-based devices for faults occurring shortly after ICMP echo processing.
Review network telemetry for high-rate ICMPv4 echo traffic toward IoT or embedded endpoints.

Monitoring Recommendations

Log and alert on ICMP echo request floods targeting embedded device subnets.
Track device availability and unexpected reboot events on Zephyr-based fleets.
Capture and review serial console output from production devices for stack traces involving the IPv4 path.

How to Mitigate CVE-2026-10639

Immediate Actions Required

Identify all Zephyr-based devices running affected versions through v4.4.0.
Update vulnerable images to a Zephyr release containing commit 86e21665d4641f304dc3895bfb03b8f89db83291.
Restrict ICMPv4 echo requests to Zephyr devices at the network perimeter where firmware updates are not yet possible.

Patch Information

The upstream fix is published in the Zephyr project. See the Zephyr Security Advisory GHSA-qhrf-w466-qmpw and the upstream commit 86e21665. The patch introduces struct net_if *iface = net_pkt_iface(pkt); to capture the interface from the caller-owned received packet before the send call, and replaces the post-send net_pkt_iface(reply) reads with the cached iface value.

Workarounds

Disable CONFIG_NET_STATISTICS_ICMP in the Zephyr build configuration to eliminate the vulnerable stats call path.
Block inbound ICMPv4 echo requests at upstream firewalls or gateways protecting embedded devices.
Where feasible, disable IPv4 on Zephyr devices that do not require it.

bash

# Disable ICMP statistics in prj.conf to remove the vulnerable code path
CONFIG_NET_STATISTICS_ICMP=n