CVE-2026-15893: IPv6 Neighbor Discovery DOS Vulnerability

CVE-2026-15893 Overview

CVE-2026-15893 is a denial-of-service vulnerability in the Zephyr real-time operating system (RTOS) IPv6 stack. The flaw resides in net_if_ipv6_calc_reachable_time() within subsys/net/ip/net_if.c. An attacker on the local link can send a single unauthenticated Router Advertisement (RA) with a Reachable Time field of 1 to force the computed reachable time to zero. This condition either triggers a fatal kernel assertion (NET_ASSERT) or degrades Neighbor Discovery by arming the reachable timer with K_MSEC(0). The vulnerability is tracked under [CWE-617: Reachable Assertion].

Critical Impact
A single link-local Router Advertisement can crash a Zephyr device with assertions enabled or force perpetual neighbor re-solicitation, disrupting IPv6 connectivity on the target.

Affected Products

Zephyr Project RTOS — IPv6 networking subsystem (subsys/net/ip/net_if.c, subsys/net/ip/ipv6_nbr.c)
Builds with CONFIG_ASSERT enabled experience fatal kernel crashes
Builds without assertions experience degraded Neighbor Discovery behavior

Discovery Timeline

2026-09-14 - CVE-2026-15893 published to NVD
2026-09-14 - Last updated in NVD database
Additional technical details available in GitHub Security Advisory GHSA-8v32-9xf8-r765

Technical Details for CVE-2026-15893

Vulnerability Analysis

The function net_if_ipv6_calc_reachable_time() derives a randomized Neighbor Discovery reachable time using the formula min_reachable + sys_rand32_get() % (max_reachable - min_reachable). It computes min_reachable as base/2 and max_reachable as 3*base/2 using integer division. When base_reachable_time equals 1, both bounds collapse to zero. The function returns 0, and net_if_ipv6_set_reachable_time() stores that value into ipv6->reachable_time.

When the network stack subsequently confirms a neighbor as reachable, net_ipv6_nbr_set_reachable_timer() reads the stored zero value. On builds compiled with CONFIG_ASSERT enabled, this triggers NET_ASSERT(time, "Zero reachable timeout!") and produces a fatal kernel assertion. On builds without assertions, the reachable timer fires immediately, forcing neighbors into the STALE state and driving continuous re-solicitation.

Root Cause

The root cause is an unchecked integer-division edge case combined with acceptance of attacker-controlled input. The function does not validate that base_reachable_time yields a nonzero range before applying the modulus. The impact is limited to availability; there is no memory-safety, confidentiality, or integrity consequence.

Attack Vector

Router Advertisements are unauthenticated by default and require only Layer 2 adjacency to the target link. The handler handle_ra_input() in subsys/net/ip/ipv6_nbr.c accepts any nonzero Reachable Time value less than or equal to MAX_REACHABLE_TIME. An adjacent attacker sends one crafted RA carrying Reachable Time = 1 to drive the internal reachable time to zero on all listening Zephyr hosts.

 uint32_t net_if_ipv6_calc_reachable_time(struct net_if_ipv6 *ipv6)
 {
 	uint32_t min_reachable, max_reachable;
+	uint32_t spread;
+
+	if (ipv6->base_reachable_time == 0U) {
+		return REACHABLE_TIME;
+	}
 
 	min_reachable = (MIN_RANDOM_NUMER * ipv6->base_reachable_time)
 			/ MIN_RANDOM_DENOM;
 	max_reachable = (MAX_RANDOM_NUMER * ipv6->base_reachable_time)
 			/ MAX_RANDOM_DENOM;
 
+	/* RFC 4861 uses MIN_RANDOM_FACTOR (1/2); round up so the range is never 0 ms */
+	if (min_reachable == 0U) {
+		min_reachable = 1U;
+	}
+
 	NET_DBG("min_reachable:%u max_reachable:%u", min_reachable,
 		max_reachable);
 
-	return min_reachable +
-	       sys_rand32_get() % (max_reachable - min_reachable);
+	if (max_reachable <= min_reachable) {
+		return min_reachable;
+	}
+
+	spread = max_reachable - min_reachable;

Source: Zephyr patch commit 251079e. This patch adds guards for zero base_reachable_time, ensures min_reachable never rounds to zero, and returns min_reachable when the spread collapses.

Detection Methods for CVE-2026-15893

Indicators of Compromise

Router Advertisement packets on the local link carrying a Reachable Time value of 1 or other suspiciously small values.
Zephyr device kernel panics or reboots with log messages referencing "Zero reachable timeout!".
IPv6 neighbor cache entries repeatedly transitioning to the STALE state and generating continuous Neighbor Solicitations.

Detection Strategies

Deploy IPv6 Router Advertisement Guard (RA Guard) on managed switches to inspect and filter unauthorized RA sources.
Enable SEcure Neighbor Discovery (SEND) or equivalent authentication where the deployment topology supports it.
Instrument Zephyr build logs and remote telemetry to capture kernel assertion failures and unexpected reboots.

Monitoring Recommendations

Monitor Layer 2 broadcast domains for unexpected RA senders using tools such as ndpmon or rafixd.
Track Neighbor Solicitation rates per host; sustained spikes suggest degraded Neighbor Discovery.
Correlate device availability metrics with wireless or LAN segment activity to identify link-scoped denial-of-service events.

How to Mitigate CVE-2026-15893

Immediate Actions Required

Apply the upstream Zephyr fix from commit 251079e to any affected downstream build or product firmware.
Restrict which devices can send Router Advertisements on production network segments using switch-level RA Guard.
Audit deployed Zephyr firmware for CONFIG_ASSERT settings to understand whether the failure mode is a crash or persistent Neighbor Discovery degradation.

Patch Information

The official fix is available in Zephyr commit 251079ed50464aa0976eb0738a5afbe009cc9d60. The patch adds explicit checks for base_reachable_time == 0, ensures min_reachable is rounded up to at least 1, and returns min_reachable when max_reachable <= min_reachable. Vendors shipping Zephyr-based firmware should rebuild and redistribute images that incorporate this commit. Additional context is documented in GitHub Security Advisory GHSA-8v32-9xf8-r765.

Workarounds

Enable RA Guard on Layer 2 infrastructure to drop RAs from unauthorized ports.
Disable IPv6 autoconfiguration on Zephyr devices that do not require it, if the build permits.
Segment IoT and embedded devices onto isolated VLANs to limit adjacent-network exposure.

bash

# Cisco example: enable IPv6 RA Guard on access ports
ipv6 nd raguard policy HOST_POLICY
 device-role host
!
interface range GigabitEthernet1/0/1 - 24
 ipv6 nd raguard attach-policy HOST_POLICY