CVE-2026-10637: Zephyr IPv6 MLD Use-After-Free Denial of Service

Technical summary

CVE-2026-10637 is a use-after-free vulnerability (CWE-416) in subsys/net/ip/ipv6_mld.c:mld_send(). The function calls net_send_data(pkt) and then attempts to read the packet's interface pointer via net_pkt_iface(pkt) and update per-interface statistics. However, the Zephyr network stack's ownership contract explicitly transfers packet ownership to the L2 driver upon successful send; the driver frees the packet and returns it to the memory pool. The subsequent read of the freed packet object is therefore a use-after-free. If the freed memory slot is reallocated concurrently, pkt->iface may be NULL (triggering a null dereference crash) or contain stale/garbage data (resulting in a stray write and memory corruption). The vulnerability is reachable remotely without authentication via handle_mld_query(), which responds to valid MLDv2 General Queries (unspecified multicast address, hop limit 1) by invoking send_mld_report() and then mld_send(). The IPv4/IGMP equivalent (igmp_send) implements the corrected pattern of caching the interface before sending.

Business impact

This vulnerability exposes Zephyr-based IoT and embedded network devices to remotely triggered denial of service attacks from any system on the local network segment. An attacker can repeatedly crash the networking stack, rendering network-dependent functionality unavailable and potentially causing extended service disruption. The narrow possibility of memory corruption could enable further exploitation in multi-threat scenarios. Devices in uncontrolled networks (industrial IoT, public sensing deployments, edge gateways) are at elevated risk. Recovery typically requires device reboot, incurring operational overhead and potential data loss in applications maintaining in-flight transactions.

Affected systems

Zephyr RTOS projects and products using Zephyr for IPv6 networking with MLD support enabled. Specifically, any Zephyr-based system that processes IPv6 multicast queries on a local network. The vulnerability requires CONFIG_NET_STATISTICS_PER_INTERFACE to trigger the most obvious crash path (null dereference), though memory corruption scenarios may occur even without that configuration. Systems without IPv6 enabled or those not exposed to untrusted local networks are unaffected.

Exploitability

Exploitability is high on local network segments. No authentication or user interaction is required; a remote attacker simply transmits a standard MLDv2 General Query packet to trigger the flaw. The attack is deterministic for denial of service (stack crash/reboot). The memory corruption pathway is narrow and non-deterministic—successful exploitation to achieve arbitrary write or code execution would require precise timing and heap state knowledge, making it a lower-probability outcome but not ruled out in multi-stage attack chains. The attack requires network-layer access to the target (same link-local segment) and cannot be executed across routed networks.

Remediation

The fix caches the interface pointer in a local variable before calling net_send_data(), and refrains from accessing the packet after the send returns successfully. This aligns mld_send() with the documented ownership contract and the pre-existing correct implementation in the IPv4/IGMP path. Patched versions should be available from the Zephyr project; consult official release notes and security advisories for the specific version addressing this CVE.

Patch guidance

Upgrade Zephyr to a patched version released after the vulnerability disclosure. Check the official Zephyr security advisory and release notes for the specific version that includes the fix to subsys/net/ip/ipv6_mld.c:mld_send(). Verify the fix by confirming that the interface is cached prior to net_send_data() and that no packet metadata is read post-send. Test in a development environment before deploying to production devices, particularly if the target device runs critical network services.

Detection guidance

Monitor for repeated IPv6 MLD-related crashes or unexpected reboots of Zephyr devices, particularly if preceded by MLD query traffic from unknown sources on the local network. Network intrusion detection systems (IDS) can identify suspicious MLDv2 General Query patterns sent to multi-target broadcast addresses. Device logs and kernel crashes may indicate use-after-free faults (NULL dereference, segmentation fault, or memory corruption symptoms) correlated with IPv6 traffic. Enable verbose logging of MLD and network statistics processing if available. Review device memory maps and heap allocator traces for concurrent allocation/deallocation of network packet objects during MLD processing.

Why prioritize this

Although classified as MEDIUM severity, this vulnerability warrants prompt prioritization for devices exposed to untrusted local networks or deployed in environments where network availability is critical. The remoteness (no physical access required), low barrier to exploitation (standard packet craft, no auth), and denial of service certainty make it a practical threat. The narrow but real possibility of memory corruption elevates risk in multi-threat scenarios. Organizations should prioritize patching based on device criticality, network trust boundaries, and exposure to potential local-network attackers.

Risk score, explained

CVSS 3.1 score of 5.9 (MEDIUM) reflects: Attack Vector (A = Adjacent) limiting to local network only; Attack Complexity (H = High) due to non-deterministic memory state for corruption scenarios; Privileges Required (N = None); User Interaction (N = None); Scope (U = Unchanged); and impact limited to Integrity (L = Low, stray write) and Availability (H = High, reliable DoS via null dereference). The score appropriately emphasizes denial of service as the primary concern while acknowledging the remote-but-local nature and the lower probability of code execution; however, the deterministic DoS and local-network assumption may warrant elevated operational priority depending on deployment context.

Frequently asked questions