CVE-2026-10640: Zephyr IPv6 Use-After-Free Vulnerability

CVE-2026-10640 Overview

CVE-2026-10640 is a use-after-free vulnerability [CWE-416] in the Zephyr real-time operating system. The flaw resides in the IPv6 Neighbor Discovery send paths inside subsys/net/ip/ipv6_nbr.c, specifically the net_ipv6_send_na, net_ipv6_send_ns, and net_ipv6_send_rs functions. These paths call net_pkt_iface(pkt) after net_send_data(pkt) has already returned, by which point the L2 driver may have released the packet's last reference and freed the slab block. The bug is reachable when CONFIG_NET_STATISTICS_PER_INTERFACE is enabled and affects Zephyr versions v3.3.0 through v4.4.0.

Critical Impact
Any unauthenticated on-link node can trigger the use-after-free by sending ICMPv6 Neighbor Solicitations, producing corrupted statistics, faults, or limited memory corruption.

Affected Products

Zephyr RTOS v3.3.0 through v4.4.0
Builds with native IPv6 enabled and Neighbor Discovery active
Configurations with CONFIG_NET_STATISTICS_PER_INTERFACE enabled

Discovery Timeline

2026-06-16 - CVE-2026-10640 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-10640

Vulnerability Analysis

The vulnerability stems from a lifetime mismatch between a network packet and the code that reports statistics about it. On the success path of net_send_data(pkt), the network stack takes ownership of the freshly allocated packet whose reference count is 1. Lower-layer functions such as ethernet_send invoke net_pkt_unref, returning the underlying slab block to the pool.

After net_send_data returns, the IPv6 Neighbor Discovery code still executes net_stats_update_icmp_sent(net_pkt_iface(pkt)). The call reads the iface field from a slab block that may already be free. When no TX queue thread is configured, the free happens synchronously before the read. With a TX thread, a concurrent unref can free the block before the statistics line runs.

If the freed slab block has been reallocated, the loaded pointer points to unrelated memory. Dereferencing it to increment iface->stats.icmp.sent can corrupt statistics, fault the device, or write to attacker-influenced memory.

Root Cause

The send routines passed the wrong source for the interface pointer. The functions already held a valid iface argument on the stack, but instead retrieved the interface from the packet after relinquishing ownership of it. This violates the rule that callers must not touch a packet whose reference they have released.

Attack Vector

The Neighbor Advertisement path is reachable by any unauthenticated node on the same link. An attacker on the local IPv6 segment sends ICMPv6 Neighbor Solicitations to the Zephyr device. The handler handle_ns_input calls net_ipv6_send_na, which triggers the post-send dereference. No authentication or user interaction is required.

		goto drop;
	}

-	net_stats_update_icmp_sent(net_pkt_iface(pkt));
+	net_stats_update_icmp_sent(iface);
	net_stats_update_ipv6_nd_sent(iface);

	return 0;

Source: Zephyr commit aaed8332

The patch replaces net_pkt_iface(pkt) with the already-available iface argument, eliminating the read from the freed packet.

Detection Methods for CVE-2026-10640

Indicators of Compromise

Unexpected device resets, hard faults, or memory protection unit (MPU) exceptions on Zephyr nodes shortly after receiving IPv6 traffic
Inconsistent or wildly inflated values in per-interface stats.icmp.sent counters
Bursts of inbound ICMPv6 Neighbor Solicitation packets targeting embedded nodes on the link

Detection Strategies

Inspect Zephyr builds for the vulnerable versions (v3.3.0 through v4.4.0) and verify whether CONFIG_NET_STATISTICS_PER_INTERFACE is enabled
Capture link-local traffic with tcpdump or Wireshark and flag abnormal volumes of icmp6.type == 135 (Neighbor Solicitation) directed at IoT endpoints
Correlate firmware crash logs with timestamps of incoming Neighbor Discovery traffic

Monitoring Recommendations

Enable serial console or RTT logging on Zephyr devices to record fault contexts pointing into ipv6_nbr.c
Monitor switch and router counters for sustained Neighbor Solicitation floods originating from a single MAC address
Track device reboot frequency in fleet management telemetry to identify nodes exhibiting unexplained restarts

How to Mitigate CVE-2026-10640

Immediate Actions Required

Upgrade Zephyr-based firmware to a release that includes commit aaed8332a62b0490a2f3c2cbabe272f575068eaa or later
Inventory all deployed devices running Zephyr v3.3.0 through v4.4.0 with IPv6 networking enabled
Restrict untrusted devices from sharing a link with vulnerable embedded nodes until firmware is updated

Patch Information

The Zephyr project addressed the issue in commit aaed8332a62b0490a2f3c2cbabe272f575068eaa, which uses the local iface variable rather than reading the interface pointer from a packet whose reference has been released. Full details are available in the Zephyr Security Advisory GHSA-r74c-mr4m-7g9g and the upstream commit.

Workarounds

Disable CONFIG_NET_STATISTICS_PER_INTERFACE in the Zephyr build configuration; the global counter path does not perform the freed-memory dereference
Place affected devices on isolated VLANs or segments that exclude untrusted hosts capable of sending ICMPv6 Neighbor Solicitations
Disable native IPv6 on devices that do not require it until a patched firmware image is deployed

bash

# Disable per-interface network statistics in prj.conf to avoid the vulnerable code path
CONFIG_NET_STATISTICS_PER_INTERFACE=n