CVE-2026-7656: Zephyr IPv6 Neighbor Discovery Logic Bypass – High Severity

Technical summary

The vulnerability exists in subsys/net/ip/ipv6_nbr.c across three Neighbor Discovery input handlers (handle_ra_input, handle_ns_input, handle_na_input). The buggy validation logic uses an AND operator to combine RFC 4861 checks (length, hop-limit, source validation, target checks) with an ICMPv6 code check: ((checks) && (icmp_hdr->code != 0)). Because all legitimate ND packets carry code 0, this always forces the entire condition false. The packet passes through without executing any of the preceding checks, including the mandatory Hop-Limit-255 verification that normally confines ND processing to on-link senders. For Router Advertisements, the bypassed checks also include source address link-local validation and multicast destination sanity. The underlying net_pkt_* parsing primitives (net_pkt_get_data, net_pkt_read, net_pkt_skip) remain bounds-safe; the flaw is pure input validation failure. The defect has been present since 2018 and shipped in all Zephyr releases through v4.4.0.

Business impact

An attacker on the same network segment can alter network configuration without authentication. Forged Router Advertisements allow redirection of default traffic to an attacker-controlled gateway, enabling traffic inspection, modification, or blocking. DNS hijacking via RDNSS-capable RA crafting can silently redirect name resolution. Forged Neighbor Advertisement/Solicitation messages poison the neighbor cache, enabling man-in-the-middle attacks against IPv6-capable IoT, embedded, and edge devices running Zephyr. For organizations deploying Zephyr in industrial IoT, smart home, or healthcare edge environments, this creates a silent infrastructure compromise risk: attackers can intercept or redirect device communication without modifying the devices themselves. Remote exploitation through off-link packet forwarding is also possible in multi-hop scenarios, expanding the attack surface beyond physically adjacent networks.

Affected systems

All Zephyr Project releases through version 4.4.0 are affected when IPv6 is enabled. The vulnerability is hardcoded in the Neighbor Discovery handlers, so any Zephyr device or application implementing IPv6 communication is susceptible. This includes Zephyr-based IoT gateways, sensor hubs, wearables, industrial controllers, and edge nodes. Systems with CONFIG_NET_IPV6_RA_RDNSS enabled face additional DNS-hijacking risk. Devices that never process Router Advertisements or Neighbor Discovery messages (e.g., Zephyr instances running in DNS-only or non-IP-stack scenarios) may be unaffected; verify your Zephyr build configuration.

Exploitability

Exploitability is straightforward for on-link attackers: crafting IPv6 ICMP ND packets with code 0 (standard value) and spoofed source addresses is trivial using existing tools (e.g., THC IPv6, scapy, custom scripts). No user interaction is required; passive network presence is sufficient. The main constraint is on-link access—the attacker must share a network segment or have a path through a misconfigured router. However, because the Hop-Limit-255 check is bypassed, sophisticated attackers can send ND packets with incremented Hop Limit values and forward them through intervening routers, potentially reaching off-link targets in poorly segmented networks. CVSS 8.1 (HIGH) reflects high integrity and availability impact with low complexity; the AV:A (Adjacent) rating assumes on-link presence, but the Hop-Limit bypass partially mitigates that assumption.

Remediation

Upgrade to a patched Zephyr release. Vendors shipping Zephyr should apply the fix immediately: the corrected logic separates the boolean condition so that any individual check failure causes packet rejection. Check the Zephyr Project's official advisory for the specific patched release version and apply it to all affected deployments. Until patching, mitigate by implementing strict network segmentation, disabling IPv6 ND on untrusted network segments, or filtering ND messages at network boundaries. For devices in controlled environments (e.g., industrial facilities), restrict ND processing to trusted administrator nodes.

Patch guidance

Consult the Zephyr Project's official security advisory and release notes for the specific patched version that resolves CVE-2026-7656. The fix involves refactoring the condition in subsys/net/ip/ipv6_nbr.c to ensure each validation check independently gates packet processing. Once patched, rebuild and deploy the Zephyr image to all affected devices. Prioritize devices on public or semi-trusted networks first. Verify the fix by confirming the Zephyr version and reviewing the git commit that corrects the boolean logic in the ND handlers.

Detection guidance

Monitor network traffic for suspicious IPv6 Neighbor Discovery patterns: forged Router Advertisements from non-gateway sources, RA messages with unusual SLAAC prefixes or DNS server assignments (if RDNSS is enabled), and RA packets originating from non-link-local addresses. On the Zephyr device itself, log and alert on unexpected default-router changes, spontaneous MTU adjustments, or neighbor-cache entries for off-link sources claiming to be on-link. Use IPv6 traffic analysis tools to baseline expected ND patterns. Implement IDS signatures for out-of-scope RA sources and malformed ND packets if your monitoring stack supports IPv6 inspection. Host-based detection is limited because the Zephyr device will silently accept the forged packets; external network monitoring is more effective.

Why prioritize this

Despite a CVSS of 8.1, this warrants immediate attention due to silent, authentication-free network reconfiguration. Unlike exploits requiring code execution or memory corruption, this is a pure validation bypass requiring only network access. The bypass of the Hop-Limit-255 check is particularly concerning because it was designed to prevent exactly this kind of off-link spoofing. For any Zephyr deployment in shared or untrusted network environments (smart buildings, campuses, industrial sites), this is a critical remote-impersonation vector. The flaw's age (since 2018) means it has been shipped in countless production devices already; patching is urgent.

Risk score, explained

CVSS 8.1 reflects: Adjacent Vector (AV:A)—primarily on-link, though Hop-Limit bypass allows some off-link risk; Low Complexity (AC:L)—trivial to craft ND packets; No Privileges or User Interaction (PR:N, UI:N); Unchanged Scope (S:U); High Integrity and Availability Impact (I:H, A:H)—routing and DNS hijacking, neighbor poisoning, and traffic redirection. The score does not capture the silent, pre-authentication nature of the exploit or the fact that patching involves updating firmware on potentially thousands of embedded devices. Organizations should treat this as critically urgent for production deployments.

Frequently asked questions