CVE-2026-10637 (GCVE-0-2026-10637)

Vulnerability from cvelistv5 – Published: 2026-06-16 13:13 – Updated: 2026-10-15 22:10
VLAI
Title
Use-after-free of `net_pkt` in IPv6 MLD send path triggerable by a link-local MLD Query
Summary
subsys/net/ip/ipv6_mld.c:mld_send() read the packet interface via net_pkt_iface(pkt) after net_send_data(pkt) returned successfully. Per the network stack's ownership contract (include/zephyr/net/net_core.h, and the explicit warning in subsys/net/ip/net_core.c:453-460 'do not use pkt after that call'), a successful send transfers ownership of the net_pkt and the L2 driver frees it (e.g. ethernet_send() unrefs the packet on success, subsys/net/l2/ethernet/ethernet.c:790), returning it to its k_mem_slab. The subsequent net_pkt_iface(pkt) is therefore a read of a freed object; the recovered interface pointer is then dereferenced and incremented by the per-interface statistics path (net_stats.h UPDATE_STAT/SET_STAT) when CONFIG_NET_STATISTICS_PER_INTERFACE is enabled. If the freed slot is concurrently reallocated, pkt->iface may read back as NULL (NULL-pointer dereference / crash) or as a stale/garbage pointer (stray increment write / memory corruption). The path is reachable remotely on the local link without authentication: handle_mld_query() (registered for NET_ICMPV6_MLD_QUERY) responds to a valid MLDv2 General Query (unspecified multicast address, hop limit 1) by calling send_mld_report() -> mld_send(). The result is a remotely triggerable denial of service of the networking stack, with a narrow possibility of memory corruption. The fix caches the interface in a local before sending and no longer touches the packet after net_send_data(). The IPv4/IGMP sibling (igmp_send) already used the corrected pattern.
Severity
5.9 (Medium)
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-06-16 15:30 UTC
CWE
Assigner
zephyr CNA under the mitre root
CNA scorecard B 77/100 over 200 records in the last 180 days details
References
Impacted products
Vendor Product Version CPE status
zephyrproject zephyr Affected: 1.12.0 , < 4.3.1 (semver)
Affected: 4.4.0 , < 4.4.1 (semver)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-10637",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-16T15:30:13.376607Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-16T15:30:22.970Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://github.com/zephyrproject-rtos/zephyr",
          "defaultStatus": "unaffected",
          "packageName": "zephyr",
          "product": "zephyr",
          "programFiles": [
            "subsys/net/ip/ipv6_mld.c"
          ],
          "vendor": "zephyrproject",
          "versions": [
            {
              "lessThan": "4.3.1",
              "status": "affected",
              "version": "1.12.0",
              "versionType": "semver"
            },
            {
              "lessThan": "4.4.1",
              "status": "affected",
              "version": "4.4.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "subsys/net/ip/ipv6_mld.c:mld_send() read the packet interface via net_pkt_iface(pkt) after net_send_data(pkt) returned successfully. Per the network stack\u0027s ownership contract (include/zephyr/net/net_core.h, and the explicit warning in subsys/net/ip/net_core.c:453-460 \u0027do not use pkt after that call\u0027), a successful send transfers ownership of the net_pkt and the L2 driver frees it (e.g. ethernet_send() unrefs the packet on success, subsys/net/l2/ethernet/ethernet.c:790), returning it to its k_mem_slab.\n\nThe subsequent net_pkt_iface(pkt) is therefore a read of a freed object; the recovered interface pointer is then dereferenced and incremented by the per-interface statistics path (net_stats.h UPDATE_STAT/SET_STAT) when CONFIG_NET_STATISTICS_PER_INTERFACE is enabled. If the freed slot is concurrently reallocated, pkt-\u003eiface may read back as NULL (NULL-pointer dereference / crash) or as a stale/garbage pointer (stray increment write / memory corruption).\n\nThe path is reachable remotely on the local link without authentication: handle_mld_query() (registered for NET_ICMPV6_MLD_QUERY) responds to a valid MLDv2 General Query (unspecified multicast address, hop limit 1) by calling send_mld_report() -\u003e mld_send().\n\nThe result is a remotely triggerable denial of service of the networking stack, with a narrow possibility of memory corruption. The fix caches the interface in a local before sending and no longer touches the packet after net_send_data(). The IPv4/IGMP sibling (igmp_send) already used the corrected pattern."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-416",
              "description": "use-after-free",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-15T22:10:01.063Z",
        "orgId": "e2e69745-5e70-4e92-8431-deb5529a81ad",
        "shortName": "zephyr"
      },
      "references": [
        {
          "name": "Fix commit",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/zephyrproject-rtos/zephyr/commit/3159c53e8e7d233c2a85a0798cf25ac441db6dae"
        },
        {
          "name": "GHSA-m23w-34pp-4h92",
          "url": "https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-m23w-34pp-4h92"
        }
      ],
      "title": "Use-after-free of `net_pkt` in IPv6 MLD send path triggerable by a link-local MLD Query",
      "x_generator": {
        "engine": "cvelib 1.8.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "e2e69745-5e70-4e92-8431-deb5529a81ad",
    "assignerShortName": "zephyr",
    "cveId": "CVE-2026-10637",
    "datePublished": "2026-06-16T13:13:16.034Z",
    "dateReserved": "2026-06-02T15:10:54.577Z",
    "dateUpdated": "2026-10-15T22:10:01.063Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-10637",
      "date": "2026-10-27",
      "epss": "0.00299",
      "percentile": "0.22476"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "collectionURL": "https://github.com/zephyrproject-rtos/zephyr",
                "defaultStatus": "unaffected",
                "packageName": "zephyr",
                "product": "zephyr",
                "programFiles": [
                  "subsys/net/ip/ipv6_mld.c"
                ],
                "vendor": "zephyrproject",
                "versions": [
                  {
                    "lessThan": "4.3.1",
                    "status": "affected",
                    "version": "1.12.0",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "4.4.1",
                    "status": "affected",
                    "version": "4.4.0",
                    "versionType": "semver"
                  }
                ]
              }
            ],
            "source": "vulnerabilities@zephyrproject.org"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:zephyrproject:zephyr:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "E03B5738-05F2-483A-8CC1-97F83A729DE2",
                    "versionEndExcluding": "4.5.0",
                    "versionStartIncluding": "1.12.0",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "subsys/net/ip/ipv6_mld.c:mld_send() read the packet interface via net_pkt_iface(pkt) after net_send_data(pkt) returned successfully. Per the network stack\u0027s ownership contract (include/zephyr/net/net_core.h, and the explicit warning in subsys/net/ip/net_core.c:453-460 \u0027do not use pkt after that call\u0027), a successful send transfers ownership of the net_pkt and the L2 driver frees it (e.g. ethernet_send() unrefs the packet on success, subsys/net/l2/ethernet/ethernet.c:790), returning it to its k_mem_slab.\n\nThe subsequent net_pkt_iface(pkt) is therefore a read of a freed object; the recovered interface pointer is then dereferenced and incremented by the per-interface statistics path (net_stats.h UPDATE_STAT/SET_STAT) when CONFIG_NET_STATISTICS_PER_INTERFACE is enabled. If the freed slot is concurrently reallocated, pkt-\u003eiface may read back as NULL (NULL-pointer dereference / crash) or as a stale/garbage pointer (stray increment write / memory corruption).\n\nThe path is reachable remotely on the local link without authentication: handle_mld_query() (registered for NET_ICMPV6_MLD_QUERY) responds to a valid MLDv2 General Query (unspecified multicast address, hop limit 1) by calling send_mld_report() -\u003e mld_send().\n\nThe result is a remotely triggerable denial of service of the networking stack, with a narrow possibility of memory corruption. The fix caches the interface in a local before sending and no longer touches the packet after net_send_data(). The IPv4/IGMP sibling (igmp_send) already used the corrected pattern."
          },
          {
            "lang": "es",
            "value": "subsys/net/ip/ipv6_mld.c:mld_send() ley\u00f3 la interfaz del paquete a trav\u00e9s de net_pkt_iface(pkt) despu\u00e9s de que net_send_data(pkt) regresara exitosamente. Seg\u00fan el contrato de propiedad de la pila de red (include/zephyr/net/net_core.h, y la advertencia expl\u00edcita en subsys/net/ip/net_core.c:453-460 \u2019do not use pkt after that call\u2019), un env\u00edo exitoso transfiere la propiedad del net_pkt y el controlador L2 lo libera (por ejemplo, ethernet_send() desreferencia el paquete al tener \u00e9xito, subsys/net/l2/ethernet/ethernet.c:790), devolvi\u00e9ndolo a su k_mem_slab. El subsiguiente net_pkt_iface(pkt) es, por lo tanto, una lectura de un objeto liberado; el puntero de interfaz recuperado es luego desreferenciado e incrementado por la ruta de estad\u00edsticas por interfaz (net_stats.h UPDATE_STAT/SET_STAT) cuando CONFIG_NET_STATISTICS_PER_INTERFACE est\u00e1 habilitado. Si el slot liberado es reasignado concurrentemente, pkt-iface puede leerse como NULL (desreferencia de puntero NULL / ca\u00edda) o como un puntero obsoleto/basura (escritura de incremento errante / corrupci\u00f3n de memoria). La ruta es alcanzable remotamente en el enlace local sin autenticaci\u00f3n: handle_mld_query() (registrado para NET_ICMPV6_MLD_QUERY) responde a una consulta general MLDv2 v\u00e1lida (direcci\u00f3n de multidifusi\u00f3n no especificada, l\u00edmite de salto 1) llamando a send_mld_report() - mld_send(). El resultado es una denegaci\u00f3n de servicio de la pila de red que puede ser activada remotamente, con una estrecha posibilidad de corrupci\u00f3n de memoria. La soluci\u00f3n almacena en cach\u00e9 la interfaz en una variable local antes de enviar y ya no toca el paquete despu\u00e9s de net_send_data(). El hermano IPv4/IGMP (igmp_send) ya utilizaba el patr\u00f3n corregido."
          }
        ],
        "id": "CVE-2026-10637",
        "lastModified": "2026-10-26T12:10:00.130",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "HIGH",
                "attackVector": "ADJACENT_NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 5.9,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "LOW",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.6,
              "impactScore": 4.2,
              "source": "vulnerabilities@zephyrproject.org",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "ADJACENT_NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 7.1,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "NONE",
                "integrityImpact": "LOW",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 2.8,
              "impactScore": 4.2,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-10637",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-16T15:30:13.376607Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-06-16T15:16:33.987",
        "references": [
          {
            "source": "vulnerabilities@zephyrproject.org",
            "tags": [
              "Patch"
            ],
            "url": "https://github.com/zephyrproject-rtos/zephyr/commit/3159c53e8e7d233c2a85a0798cf25ac441db6dae"
          },
          {
            "source": "vulnerabilities@zephyrproject.org",
            "tags": [
              "Exploit",
              "Patch",
              "Vendor Advisory"
            ],
            "url": "https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-m23w-34pp-4h92"
          }
        ],
        "sourceIdentifier": "vulnerabilities@zephyrproject.org",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-416"
              }
            ],
            "source": "vulnerabilities@zephyrproject.org",
            "type": "Secondary"
          }
        ]
      }
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-10637",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-06-16T15:30:13.376607Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-06-16T15:30:17.187Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "collectionURL": "https://github.com/zephyrproject-rtos/zephyr",
              "defaultStatus": "unaffected",
              "packageName": "zephyr",
              "product": "zephyr",
              "programFiles": [
                "subsys/net/ip/ipv6_mld.c"
              ],
              "vendor": "zephyrproject",
              "versions": [
                {
                  "lessThan": "4.3.1",
                  "status": "affected",
                  "version": "1.12.0",
                  "versionType": "semver"
                },
                {
                  "lessThan": "4.4.1",
                  "status": "affected",
                  "version": "4.4.0",
                  "versionType": "semver"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "subsys/net/ip/ipv6_mld.c:mld_send() read the packet interface via net_pkt_iface(pkt) after net_send_data(pkt) returned successfully. Per the network stack\u0027s ownership contract (include/zephyr/net/net_core.h, and the explicit warning in subsys/net/ip/net_core.c:453-460 \u0027do not use pkt after that call\u0027), a successful send transfers ownership of the net_pkt and the L2 driver frees it (e.g. ethernet_send() unrefs the packet on success, subsys/net/l2/ethernet/ethernet.c:790), returning it to its k_mem_slab.\n\nThe subsequent net_pkt_iface(pkt) is therefore a read of a freed object; the recovered interface pointer is then dereferenced and incremented by the per-interface statistics path (net_stats.h UPDATE_STAT/SET_STAT) when CONFIG_NET_STATISTICS_PER_INTERFACE is enabled. If the freed slot is concurrently reallocated, pkt-\u003eiface may read back as NULL (NULL-pointer dereference / crash) or as a stale/garbage pointer (stray increment write / memory corruption).\n\nThe path is reachable remotely on the local link without authentication: handle_mld_query() (registered for NET_ICMPV6_MLD_QUERY) responds to a valid MLDv2 General Query (unspecified multicast address, hop limit 1) by calling send_mld_report() -\u003e mld_send().\n\nThe result is a remotely triggerable denial of service of the networking stack, with a narrow possibility of memory corruption. The fix caches the interface in a local before sending and no longer touches the packet after net_send_data(). The IPv4/IGMP sibling (igmp_send) already used the corrected pattern."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "baseScore": 5.9,
                "baseSeverity": "MEDIUM",
                "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H",
                "version": "3.1"
              },
              "format": "CVSS"
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-416",
                  "description": "use-after-free",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-10-15T22:10:01.063Z",
            "orgId": "e2e69745-5e70-4e92-8431-deb5529a81ad",
            "shortName": "zephyr"
          },
          "references": [
            {
              "name": "Fix commit",
              "tags": [
                "patch"
              ],
              "url": "https://github.com/zephyrproject-rtos/zephyr/commit/3159c53e8e7d233c2a85a0798cf25ac441db6dae"
            },
            {
              "name": "GHSA-m23w-34pp-4h92",
              "url": "https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-m23w-34pp-4h92"
            }
          ],
          "title": "Use-after-free of `net_pkt` in IPv6 MLD send path triggerable by a link-local MLD Query",
          "x_generator": {
            "engine": "cvelib 1.8.0"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "e2e69745-5e70-4e92-8431-deb5529a81ad",
        "assignerShortName": "zephyr",
        "cveId": "CVE-2026-10637",
        "datePublished": "2026-06-16T13:13:16.034Z",
        "dateReserved": "2026-06-02T15:10:54.577Z",
        "dateUpdated": "2026-10-15T22:10:01.063Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

JSON

Loading timeline…




    Related by attack behaviour

    Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.