CVE-2026-19577 Overview
CVE-2026-19577 is an out-of-bounds read vulnerability [CWE-125] in the Zephyr RTOS IPv6 routing subsystem. The flaw resides in net_route_ipv6_packet() within subsys/net/ip/route_ipv6.c, which resolves a neighbor's link-layer address without first validating that the neighbor cache entry has a linked address. An unresolved neighbor carries idx == NET_NBR_LLADDR_UNKNOWN (0xff), causing net_nbr_get_lladdr() to return a pointer roughly 2.5 KB past the end of the net_neighbor_lladdr array. An unauthenticated attacker on the same link can trigger the condition remotely.
Critical Impact
Attackers on the same network segment can crash the device or leak up to 8 bytes of static RAM to any listener on the link.
Affected Products
- Zephyr RTOS with CONFIG_NET_IPV6 enabled
- Builds with CONFIG_NET_IPV6_ROUTE enabled (default when the IPv6 neighbor cache is active)
- Devices with CONFIG_NET_IPV6_MAX_NEIGHBORS set to the default value of 8
Discovery Timeline
- 2026-10-11 - CVE-2026-19577 published to NVD
- 2026-10-15 - Last updated in NVD database
Technical Details for CVE-2026-19577
Vulnerability Analysis
The vulnerability arises in net_route_ipv6_packet() when it processes a unicast IPv6 packet whose destination is not local to the receiving interface. The function calls net_nbr_get_lladdr(nbr->idx) to resolve the next-hop link-layer address without checking whether the neighbor cache entry has a valid link-layer binding. When the neighbor is in the INCOMPLETE state, nbr->idx equals NET_NBR_LLADDR_UNKNOWN (0xff), and net_nbr_get_lladdr() in subsys/net/ip/nbr.c performs no runtime bounds check beyond a NET_ASSERT.
The function returns &net_neighbor_lladdr[255], which lies approximately 2.5 KB past the end of the array whose default size is 8. Because the returned pointer is non-NULL, the subsequent lladdr == NULL guard fails to catch the error. On builds with CONFIG_ASSERT enabled, the assertion fires and the device panics, producing a repeatable remote denial of service.
When assertions are disabled, the stale out-of-bounds struct net_linkaddr drives a memcmp() against uncontrolled memory. If its len byte passes the NET_LINK_ADDR_MAX_LENGTH check, up to 8 bytes of unrelated static RAM are copied into the outgoing frame's destination link-layer address and transmitted on the link.
Root Cause
The root cause is a missing precondition check before dereferencing the neighbor index. net_route_ipv6_get_info() returns the packet destination itself as the next hop when a cache entry exists, and the lookup does not skip INCOMPLETE entries. The downstream resolver trusts the index without validating that a link-layer address has been bound to it.
Attack Vector
An unauthenticated attacker on the same link forces a neighbor into the unresolved state. This can be done by eliciting traffic to a spoofed, non-existent neighbor address so that net_ipv6_send_ns() creates an INCOMPLETE entry, or by sending a Router Advertisement with no source link-layer address option, which creates a persistently unresolved router neighbor. The attacker then sends a packet addressed to that neighbor to trigger the out-of-bounds read.
net_route_ll_addr_supported(out_iface) &&
net_route_ll_addr_supported(net_pkt_iface(pkt)) &&
net_route_ll_addr_supported(net_pkt_orig_iface(pkt))) {
+ if (nbr->idx == NET_NBR_LLADDR_UNKNOWN) {
+ NET_DBG("Neighbor %s has no link-layer (idx unknown)",
+ net_sprint_ipv6_addr(nexthop));
+ return -ESRCH;
+ }
+
lladdr = net_nbr_get_lladdr(nbr->idx);
if (lladdr == NULL) {
NET_DBG("Cannot find %s neighbor link layer address.",
Source: Zephyr Project patch commit b0b0e89
Detection Methods for CVE-2026-19577
Indicators of Compromise
- Unexpected device panics or reboots on IPv6-capable Zephyr endpoints coinciding with inbound IPv6 unicast traffic
- Router Advertisement messages on the local link that omit the source link-layer address option
- Neighbor Solicitation storms targeting addresses that never resolve
- Outbound Ethernet frames with destination MAC addresses that do not correspond to any known neighbor
Detection Strategies
- Monitor link-local IPv6 traffic for malformed Router Advertisements lacking the SLLAO option
- Correlate device crash telemetry with recent IPv6 Neighbor Discovery activity on the same segment
- Inspect outbound frames from Zephyr-based devices for destination MAC values that do not match ARP or NDP caches
Monitoring Recommendations
- Enable IPv6 Neighbor Discovery logging on managed switches serving Zephyr devices
- Baseline crash and watchdog reset counters for embedded devices to flag anomalous spikes
- Capture packet traces on segments hosting IoT devices to retain evidence of adjacent-network probes
How to Mitigate CVE-2026-19577
Immediate Actions Required
- Apply the upstream Zephyr patch from commit b0b0e89 to all affected firmware images
- Rebuild and redeploy firmware for every Zephyr device with CONFIG_NET_IPV6_ROUTE enabled
- Restrict adjacent-network access to IPv6-capable embedded devices by segmenting them from untrusted endpoints
Patch Information
The fix adds an explicit check for nbr->idx == NET_NBR_LLADDR_UNKNOWN before calling net_nbr_get_lladdr(), returning -ESRCH when the neighbor has no link-layer binding. Refer to the GitHub Security Advisory GHSA-vv76-4m89-95q5 and the upstream patch commit for integration details.
Workarounds
- Disable CONFIG_NET_IPV6_ROUTE where IPv6 forwarding is not required by the application
- Deploy RA Guard or equivalent switch-level filtering to block malformed Router Advertisements
- Place vulnerable devices on isolated VLANs where only trusted neighbors can reach them
# Kconfig workaround: disable IPv6 routing where not required
# In prj.conf for the Zephyr build
CONFIG_NET_IPV6_ROUTE=n
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
