CVE-2026-12633: IPv6 Neighbor Discovery DoS Vulnerability

CVE-2026-12633 Overview

CVE-2026-12633 is an out-of-bounds write vulnerability [CWE-787] in the Zephyr RTOS IPv6 neighbor-discovery code located in subsys/net/ip/ipv6_nbr.c. The flaw resides in handle_ra_6co(), which processes 6LoWPAN Context Options (6CO) inside ICMPv6 Router Advertisements per RFC 6775. The handler accepts an 8-bit context_len value from the packet without enforcing the RFC-mandated maximum of 128 bits. An attacker on the same link can trigger a size_t underflow in a memset call, producing an unbounded wild write into kernel memory.

Critical Impact
A single crafted Router Advertisement from any unauthenticated host on the local link triggers an unbounded out-of-bounds memset that zeroes kernel memory, causing memory corruption and denial of service.

Affected Products

Zephyr RTOS builds with CONFIG_NET_6LO_CONTEXT enabled
IPv6 neighbor-discovery subsystem (subsys/net/ip/ipv6_nbr.c)
Devices exposing an IPv6 interface to an untrusted link

Discovery Timeline

2026-08-19 - CVE-2026-12633 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-12633

Vulnerability Analysis

The defect resides in handle_ra_6co() within subsys/net/ip/ipv6_nbr.c. The function reads the 8-bit context_len field directly from the received 6CO option and uses it to compute a memset length without bounding it to the RFC 6775 maximum of 128. The context->prefix buffer is a fixed 16-byte array. The code computes context->context_len / 8 and then calls memset(context->prefix + context_len/8, 0, sizeof(context->prefix) - context_len/8).

When context_len falls between 136 and 255, the division yields values of 17 through 31. Subtracting these from sizeof(context->prefix) (16) underflows the unsigned size_t argument, resolving to roughly SIZE_MAX. The resulting memset zeroes memory far beyond the 6lo context structure, corrupting adjacent kernel state until the system faults.

Root Cause

The pre-fix validation only checked the option-length field and the constraint that context_len > 64 requires len == 3. It never rejected context_len values greater than 128. This missing bounds check allows the subsequent arithmetic to underflow.

Attack Vector

Router Advertisements are link-scoped ICMPv6 messages and are not forwarded by routers. Any unauthenticated host on the same link can send a crafted RA containing a 6CO option with context_len between 136 and 255 and the option length field set to 3. A single packet reaches handle_ra_6co() and triggers the wild write.

	 * bits in the Context Prefix field that are valid.  The value ranges
	 * from 0 to 128.  If it is more than 64, then the Length MUST be 3.
	 */
-	if ((context->context_len > 64 && len != 3U) ||
+	if (context->context_len > 128U ||
+	    (context->context_len > 64 && len != 3U) ||
	    (context->context_len <= 64U && len != 2U)) {
+		/* Per RFC 6775 the context length is at most 128. A larger
+		 * value makes context_len/8 exceed the prefix size and
+		 * underflows the memset length below.
+		 */
		return false;
	}

Source: Zephyr commit 15e838c. The patch rejects any context_len greater than 128 before the length arithmetic runs.

Detection Methods for CVE-2026-12633

Indicators of Compromise

Unexpected crashes, watchdog resets, or kernel faults on Zephyr-based devices shortly after receiving IPv6 Router Advertisements.
ICMPv6 Router Advertisement packets containing 6CO options with a context_len field greater than 128.
Repeated link-local traffic from unauthorized sources sending RAs on segments where only trusted routers should advertise.

Detection Strategies

Inspect ICMPv6 Type 134 (Router Advertisement) traffic for 6LoWPAN Context Options and flag any with context_len > 128.
Deploy RA Guard on managed switches to drop RA messages originating from non-router ports.
Correlate device crash telemetry with adjacent-network ICMPv6 activity to identify targeted exploitation attempts.

Monitoring Recommendations

Capture and log IPv6 neighbor-discovery traffic at network chokepoints serving IoT and embedded segments.
Alert on RA messages from unexpected link-local sources, especially in networks running Zephyr-based devices with 6LoWPAN enabled.
Track device reboot and crash counters on fleets running affected firmware to detect exploitation attempts.

How to Mitigate CVE-2026-12633

Immediate Actions Required

Apply the upstream Zephyr patch that bounds context_len at 128 before the arithmetic runs. See the Zephyr Security Advisory GHSA-h5m5-hm6j-cgpf.
Rebuild and reflash affected firmware images for any Zephyr device compiled with CONFIG_NET_6LO_CONTEXT.
Enable RA Guard on network infrastructure serving affected devices to block rogue Router Advertisements.

Patch Information

The fix is committed upstream in Zephyr as commit 15e838c. It adds a context->context_len > 128U check to the option validation in handle_ra_6co(), causing the handler to return false before the underflowing memset length is computed.

Workarounds

Disable CONFIG_NET_6LO_CONTEXT in the Zephyr build configuration if 6LoWPAN Context Option handling is not required.
Restrict Router Advertisement sources at the link layer using RA Guard or equivalent Layer 2 filtering.
Segment vulnerable devices onto isolated links where only trusted routers can emit RAs.

bash

# Disable the vulnerable code path in prj.conf
CONFIG_NET_6LO_CONTEXT=n