CVE-2026-10637
- Source
- https://cve.org/CVERecord?id=CVE-2026-10637
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-10637.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-10637
- Aliases
-
- GHSA-m23w-34pp-4h92
- Published
- 2026-06-16T13:13:16Z
- Modified
- 2026-10-21T09:38:09Z
- Severity
-
- 5.9 (Medium) CVSS_V3 - CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H CVSS Calculator
- Summary
- Use-after-free of `net_pkt` in IPv6 MLD send path triggerable by a link-local MLD Query
- Details
-
subsys/net/ip/ipv6_mld.c:mld_send() read the packet interface via net_pkt_iface(pkt) after net_send_data(pkt) returned successfully. Per the network stack's ownership contract (include/zephyr/net/net_core.h, and the explicit warning in subsys/net/ip/net_core.c:453-460 'do not use pkt after that call'), a successful send transfers ownership of the net_pkt and the L2 driver frees it (e.g. ethernet_send() unrefs the packet on success, subsys/net/l2/ethernet/ethernet.c:790), returning it to its k_mem_slab.
The subsequent net_pkt_iface(pkt) is therefore a read of a freed object; the recovered interface pointer is then dereferenced and incremented by the per-interface statistics path (net_stats.h UPDATE_STAT/SET_STAT) when CONFIG_NET_STATISTICS_PER_INTERFACE is enabled. If the freed slot is concurrently reallocated, pkt->iface may read back as NULL (NULL-pointer dereference / crash) or as a stale/garbage pointer (stray increment write / memory corruption).
The path is reachable remotely on the local link without authentication: handle_mld_query() (registered for NET_ICMPV6_MLD_QUERY) responds to a valid MLDv2 General Query (unspecified multicast address, hop limit 1) by calling send_mld_report() -> mld_send().
The result is a remotely triggerable denial of service of the networking stack, with a narrow possibility of memory corruption. The fix caches the interface in a local before sending and no longer touches the packet after net_send_data(). The IPv4/IGMP sibling (igmp_send) already used the corrected pattern.
- Database specific
{ "cna_assigner": "zephyr", "cwe_ids": [ "CWE-416" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/10xxx/CVE-2026-10637.json" }- References
-
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/10xxx/CVE-2026-10637.json
- https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-m23w-34pp-4h92
- https://nvd.nist.gov/vuln/detail/CVE-2026-10637
- https://github.com/zephyrproject-rtos/zephyr/commit/3159c53e8e7d233c2a85a0798cf25ac441db6dae
- https://github.com/zephyrproject-rtos/zephyr
Affected packages
Git / github.com/zephyrproject-rtos/zephyr
Affected ranges
- Type
- GIT
- Repo
- https://github.com/zephyrproject-rtos/zephyr
- Events
- Database specific
-
Show details
{ "extracted_events": [ { "range": [ { "introduced": "1.12.0" }, { "fixed": "4.3.1" } ], "source": "AFFECTED_FIELD", "strategy": "StandardRange" }, { "range": [ { "introduced": "4.4.0" }, { "fixed": "4.4.1" } ], "source": "AFFECTED_FIELD", "strategy": "StandardRange" }, { "range": [ { "fixed": "3159c53e8e7d233c2a85a0798cf25ac441db6dae" } ], "source": "REFERENCES_COMMIT" } ] }
Affected versions
v1.*
v2.*
v3.*
v4.*
zephyr-v1.*
zephyr-v2.*
zephyr-v3.*
Database specific
source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-10637.json"
vanir_signatures
[
{
"deprecated": false,
"digest": {
"function_hash": "144680731799104571886597726209930301761",
"length": 345
},
"id": "CVE-2026-10637-8e72948d",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/zephyrproject-rtos/zephyr/commit/3159c53e8e7d233c2a85a0798cf25ac441db6dae",
"target": {
"file": "subsys/net/ip/ipv6_mld.c",
"function": "mld_send"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"141080271607824276946141784652751936007",
"178665497896208158346592190385085511154",
"102501487806688596980775988094189277250",
"37627745746268865728390725292390920281",
"272824570300184854606201293376216535782",
"127594452236699840214104284704839748240",
"109602479534069600659485777729358594123",
"1437313042469205058993842840521283714",
"3154321556375386285679894176153811236",
"214335564176519044197789802125695498972",
"239137202910042472469725396291196115581",
"76056255299466034745421127401838544639",
"95219698899571549057890082437194147367",
"28882126505266844521344428504456967536"
],
"threshold": 0.9
},
"id": "CVE-2026-10637-efcb5eff",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/zephyrproject-rtos/zephyr/commit/3159c53e8e7d233c2a85a0798cf25ac441db6dae",
"target": {
"file": "subsys/net/ip/ipv6_mld.c"
}
}
]
vanir_signatures_modified
"2026-10-21T09:38:09Z"