CVE-2026-10638Medium· 5.9▾ Sunlitsubsys/net/ip/icmpv6.c reads the network interface from a net_pkt after that packet has been handed to net_try_send_data(). In icmpv6_handle_echo_request() and net_icmpv6_send_error(), the post-send statistics update calls net_pkt_iface(…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 32.5 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Aug 2.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.4%
subsys/net/ip/icmpv6.c reads the network interface from a net_pkt after that packet has been handed to net_try_send_data(). In icmpv6_handle_echo_request() and net_icmpv6_send_error(), the post-send statistics update calls net_pkt_iface(reply)/net_pkt_iface(pkt) on the just-sent packet.
The send path (net_try_send_data -> net_if_tx) unreferences and may free the packet back to its memory slab before returning — synchronously in the RX thread when no TX queue is configured (CONFIG_NET_TC_TX_COUNT == 0), and asynchronously the driver/L2 may already have freed it otherwise. net_pkt_iface() therefore dereferences a freed (and possibly reused) net_pkt; with CONFIG_NET_STATISTICS_PER_INTERFACE the stale iface pointer is further dereferenced and written through (iface->stats.icmp.sent++), turning the use-after-free read into a write through an attacker-influenceable pointer.
The core stack already documents this hazard in net_core.c ("do not use pkt after that call") and caches iface before sending; the ICMPv6 callers did not.
An unauthenticated remote attacker triggers the flaw simply by sending an ICMPv6 Echo Request (ping) or an IPv6 packet that elicits an ICMPv6 error (unknown next header, fragment reassembly timeout, destination unreachable), leading to denial of service via crash and potential memory corruption. Affected: Zephyr networking with CONFIG_NET_NATIVE_IPV6, roughly v4.2.0 through v4.4.0.
The fix caches the interface pointer before sending and uses it for all statistics updates; the sibling commit 86e21665d46 fixes the identical bug in ICMPv4.
zephyr >= 4.2.0, < 4.5.0Upgrade past the affected range:
zephyr 4.5.0Connected by shared product, vendor, weakness, or advisory.
CVE-2026-82388Medium· 5.3Use of a released HFP HF object after a failed RFCOMM connect in the Bluetooth Classic host
CVE-2026-79979High· 7.8Stale TLB entries after demand-paging page-out let arm64 user threads access reused physical frames
CVE-2026-10655Medium· 6.5Use-after-free race in SNTP async client when closing the socket while the socket service is still polling it
CVE-2026-10636Low· 3.7Use-after-free in Zephyr IPv4 IGMP send path (`igmp_send`)
CVE-2026-10637Medium· 5.9Use-after-free of `net_pkt` in IPv6 MLD send path triggerable by a link-local MLD Query
CVE-2026-10635Medium· 6.3Dangling memory-domain pointer (use-after-free) in Xtensa MMU page-table code on memory-domain de-init