CVE-2026-16515: Zephyr RTOS ICMPv6 DOS Vulnerability

CVE-2026-16515 Overview

CVE-2026-16515 affects the Zephyr real-time operating system (RTOS) IPv6 stack. The net_icmpv6_send_error() function in subsys/net/ip/icmpv6.c implements only one of the three RFC 4443 section 2.4 error-message suppression rules. The function fails to check whether the triggering packet's source address identifies a single node and whether the packet was sent to a multicast destination. An unauthenticated attacker on the same link can abuse this to turn Zephyr nodes into an ICMPv6 reflector or a multicast amplifier [CWE-406].

Critical Impact
A single spoofed IPv6 packet to ff02::1 causes every Zephyr node on the link to emit an ICMPv6 Parameter Problem message to a chosen victim, producing amplification proportional to the number of nodes.

Affected Products

Zephyr RTOS IPv6 networking stack (subsys/net/ip/icmpv6.c)
Zephyr nodes processing IPv6 extension headers (subsys/net/ip/ipv6.c)
Zephyr IPv6 fragmentation path (subsys/net/ip/ipv6_fragment.c)

Discovery Timeline

2026-09-18 - CVE-2026-16515 published to NVD
2026-09-18 - Last updated in NVD database

Technical Details for CVE-2026-16515

Vulnerability Analysis

RFC 4443 section 2.4 defines multiple suppression rules governing when a node must not send an ICMPv6 error message. Zephyr's net_icmpv6_send_error() enforces only the rule that forbids answering an ICMPv6 error with another ICMPv6 error. It omits rule e.6 (source address must identify a single node) and rule e.3 (no error in response to multicast destinations, with exceptions for NET_ICMPV6_PACKET_TOO_BIG and Parameter Problem Code 2).

Of the five call sites invoking net_icmpv6_send_error(), only the port-unreachable path in subsys/net/ip/connection.c carried an equivalent guard. The extension-header, unknown-next-header, and fragmentation paths lacked any suppression check. The impact is degraded availability of the shared link and of the reflection victim, plus attacker anonymity behind the responding nodes. Constrained mesh links such as 802.15.4/Thread amplify the effect because link-local multicast floods hop by hop.

Root Cause

The root cause is incomplete implementation of RFC 4443 error-suppression logic at a single choke point. The function accepts packets whose source address is unspecified or multicast and generates ICMPv6 errors toward multicast destinations. Packets addressed to ff02::1 are accepted unconditionally by ipv6_input(), and no upstream check rejects a multicast source, so exploitation requires no special configuration.

Attack Vector

An unauthenticated attacker with adjacent-network access exploits the flaw in two ways. First, sending a single IPv6 packet to ff02::1 with an unrecognized next-header value and a spoofed victim source address causes every Zephyr node on the link to emit an ICMPv6 Parameter Problem message to the victim. Second, sending a unicast packet whose source address is multicast causes the node to transmit its ICMPv6 error back to that multicast address, converting one unicast packet into a link-flooded frame.

	net_ipv6_addr_copy_raw(orig_src.s6_addr, ip_hdr->src);
	net_ipv6_addr_copy_raw(orig_dst.s6_addr, ip_hdr->dst);

+	if (net_ipv6_is_addr_unspecified(&orig_src) || net_ipv6_is_addr_mcast(&orig_src)) {
+		err = -EINVAL;
+		goto drop_no_pkt;
+	}
+
+	if (net_ipv6_is_addr_mcast(&orig_dst) &&
+	    type != NET_ICMPV6_PACKET_TOO_BIG &&
+	    !(type == NET_ICMPV6_PARAM_PROBLEM && code == NET_ICMPV6_PARAM_PROB_OPTION)) {
+		err = -EINVAL;
+		goto drop_no_pkt;
+	}
+
	if (ip_hdr->nexthdr == NET_IPPROTO_UDP) {
		copy_len = sizeof(struct net_ipv6_hdr) +
			sizeof(struct net_udp_hdr);

Source: Zephyr patch commit ba4247b. The patch adds both missing suppression checks at the single choke point in net_icmpv6_send_error() before any reply packet is allocated, preserving the RFC-mandated exceptions.

Detection Methods for CVE-2026-16515

Indicators of Compromise

Bursts of ICMPv6 Parameter Problem messages from multiple Zephyr nodes toward a single unicast destination on the local link.
IPv6 packets addressed to ff02::1 carrying unrecognized next-header values.
Unicast IPv6 packets arriving with a multicast source address, which is invalid per RFC 4291.
ICMPv6 error frames sent to multicast destinations without matching Packet Too Big or Parameter Problem Code 2 semantics.

Detection Strategies

Deploy link-layer packet capture on 802.15.4, Thread, or Ethernet segments hosting Zephyr devices and alert on ICMPv6 error reflection patterns.
Configure IDS rules to flag IPv6 packets whose source address falls within the multicast range ff00::/8.
Correlate ICMPv6 Parameter Problem traffic volume against baseline behavior to identify amplification events.

Monitoring Recommendations

Monitor Zephyr firmware versions and Software Bill of Materials (SBOM) entries for the vulnerable subsys/net/ip/icmpv6.c component.
Track outbound ICMPv6 error rates per device and alert on sudden increases coincident with inbound multicast traffic.
Log all traffic to ff02::1 on constrained mesh networks and investigate packets with uncommon next-header values.

How to Mitigate CVE-2026-16515

Immediate Actions Required

Apply the upstream Zephyr patch that introduces the multicast and unspecified source address checks in net_icmpv6_send_error().
Inventory all Zephyr-based IoT and embedded devices to determine exposure across production mesh and link-local segments.
Restrict network access to trusted devices only, particularly on 802.15.4/Thread mesh links where amplification is most severe.

Patch Information

The fix is available in Zephyr via commit ba4247b24ddd3a5360b617e3ca17131ca9e8026a. Additional details are provided in the Zephyr Security Advisory GHSA-v5vw-m78m-h46g. Downstream vendors shipping Zephyr firmware should rebuild and redistribute affected images.

Workarounds

Where patching is not immediately feasible, disable IPv6 on the Zephyr device if the deployment does not require it.
Filter inbound IPv6 packets with multicast source addresses at upstream routers or link-layer bridges.
Rate-limit ICMPv6 error generation on affected devices via network policy where the platform supports it.

bash

# Verify Zephyr commit contains the icmpv6 suppression fix
git -C zephyr log --oneline ba4247b24ddd3a5360b617e3ca17131ca9e8026a
git -C zephyr show ba4247b24ddd3a5360b617e3ca17131ca9e8026a -- subsys/net/ip/icmpv6.c