CVE-2026-7656: IPv6 Neighbor Discovery Auth Bypass Flaw

CVE-2026-7656 Overview

CVE-2026-7656 is an input validation flaw in the Zephyr RTOS IPv6 Neighbor Discovery (ND) handlers located in subsys/net/ip/ipv6_nbr.c. Incorrect operator precedence combined RFC 4861 validity checks with the ICMPv6 code check, causing every legitimate ND message (which uses code 0) to bypass all validation. The bypass allows forged Router Advertisement (RA), Neighbor Solicitation (NS), and Neighbor Advertisement (NA) messages to be accepted without the mandatory Hop Limit == 255 check. Attackers can hijack default routers, poison neighbor caches, and redirect traffic. The defect was introduced in 2018 and shipped in all Zephyr releases through v4.4.0.

Critical Impact
Forged IPv6 ND messages enable man-in-the-middle attacks, traffic redirection, DNS server hijacking via RDNSS, and denial of service against affected Zephyr devices.

Affected Products

Zephyr RTOS releases from 2018 through v4.4.0
Zephyr IPv6 networking stack (subsys/net/ip/ipv6_nbr.c)
Embedded and IoT devices built on affected Zephyr versions with IPv6 enabled

Discovery Timeline

2026-06-29 - CVE-2026-7656 published to NVD
2026-06-30 - Last updated in NVD database

Technical Details for CVE-2026-7656

Vulnerability Analysis

The ND handlers handle_ra_input, handle_ns_input, and handle_na_input combined multiple RFC 4861 validation conditions with the ICMPv6 code check using an incorrect boolean expression. The predicate took the form ((length/hop/source/target checks) && (icmp_hdr->code != 0)). Because every legitimate ND message carries ICMPv6 code 0, an attacker sending the normal code value causes the entire predicate to evaluate false. The packet is never dropped, and every other validity check is silently skipped.

The skipped checks include the mandatory Hop Limit == 255 verification, which proves an ND packet originated on-link and was not forwarded through a router. For Router Advertisements, the requirement that the source be a link-local address is also bypassed, along with multicast-target sanity checks. This weakness is classified as [CWE-290] Authentication Bypass by Spoofing.

Root Cause

The flaw is an input-validation and authentication weakness rather than a memory-safety issue. The underlying packet-parsing primitives net_pkt_get_data, net_pkt_read, and net_pkt_skip remain bounds-safe, and the validated length field reflects the true buffer length. Skipping the length check therefore causes no out-of-bounds access, but it disables the source-authentication guarantees the Hop Limit == 255 rule was designed to enforce.

Attack Vector

An adjacent on-link attacker can forge RA, NS, and NA messages that Zephyr accepts as legitimate. Because the Hop-Limit-255 guard is bypassed, a remote off-link attacker whose packets would normally be rejected can also inject ND messages. A forged RA lets the attacker reconfigure the victim's default router, on-link prefixes via SLAAC, MTU, reachable and retransmit timers, and DNS servers when CONFIG_NET_IPV6_RA_RDNSS is enabled. Forged NS and NA messages poison the neighbor cache to enable man-in-the-middle, traffic redirection, and denial of service.

// Security patch in subsys/net/ip/ipv6_nbr.c - splits the compound predicate
// so any failing check drops the packet.
 
 	net_stats_update_ipv6_nd_recv(net_pkt_iface(pkt));
 
-	if (((length < (sizeof(struct net_ipv6_hdr) +
-			  sizeof(struct net_icmp_hdr) +
-			  sizeof(struct net_icmpv6_ns_hdr))) ||
-	    (ip_hdr->hop_limit != NET_IPV6_ND_HOP_LIMIT)) &&
-	    (net_ipv6_is_addr_mcast(&ns_tgt) &&
-	     icmp_hdr->code != 0U)) {
+	if (length < (sizeof(struct net_ipv6_hdr) +
+		      sizeof(struct net_icmp_hdr) +
+		      sizeof(struct net_icmpv6_ns_hdr))) {
+		goto drop;
+	}
+
+	if (ip_hdr->hop_limit != NET_IPV6_ND_HOP_LIMIT) {
+		goto drop;
+	}
+
+	if (net_ipv6_is_addr_mcast(&ns_tgt)) {
+		goto drop;
+	}
+
+	if (icmp_hdr->code != 0U) {
 		goto drop;
 	}

Source: Zephyr commit 095f064c94b95f9c35e05602e693dc268f0cb865

Detection Methods for CVE-2026-7656

Indicators of Compromise

Router Advertisement messages arriving with a Hop Limit not equal to 255, indicating an off-link source.
Unexpected changes to the default route, on-link prefix list, MTU, or RDNSS-supplied DNS servers on a Zephyr device.
Neighbor cache entries where a link-layer address changes without a corresponding legitimate topology event.
RA messages whose IPv6 source is not a link-local (fe80::/10) address.

Detection Strategies

Inspect ND traffic on the local segment for ICMPv6 types 133–137 with Hop Limit values below 255.
Correlate SLAAC-derived prefix or default-router changes on Zephyr endpoints with unauthorized ND senders.
Use RA Guard on managed switches to identify unauthorized Router Advertisement sources.

Monitoring Recommendations

Enable IPv6 flow logging on gateways to record ND message sources, targets, and Hop Limit values.
Alert on multiple RA senders on segments that should contain exactly one authorized router.
Track DNS resolver changes on IoT and embedded fleets to detect RDNSS-based redirection.

How to Mitigate CVE-2026-7656

Immediate Actions Required

Upgrade Zephyr to a release containing commit 095f064c that splits the ND validation predicate.
Rebuild and reflash affected firmware images for all IoT and embedded devices running Zephyr through v4.4.0.
Disable IPv6 in device configurations where it is not required for operation.

Patch Information

The fix is available in the Zephyr project as commit 095f064c94b95f9c35e05602e693dc268f0cb865, which restructures the compound conditional into four independent checks. Details are documented in the Zephyr Security Advisory GHSA-cpjw-rvwx-ph9f and the upstream commit.

Workarounds

Deploy RA Guard (RFC 6105) on access switches to block unauthorized Router Advertisements at the network layer.
Enable DHCPv6 Snooping and ND Inspection features where supported by the network infrastructure.
Segment Zephyr-based IoT devices onto isolated VLANs with a single trusted IPv6 router.
Disable CONFIG_NET_IPV6_RA_RDNSS if RDNSS-based DNS configuration is not required.

bash

# Example: verify Zephyr version and confirm the ND validation fix is present
west list -f "{name} {revision}" | grep zephyr
grep -n "if (icmp_hdr->code != 0U)" subsys/net/ip/ipv6_nbr.c