CVE-2026-10640
- Source
- https://cve.org/CVERecord?id=CVE-2026-10640
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-10640.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-10640
- Aliases
-
- GHSA-r74c-mr4m-7g9g
- Published
- 2026-06-16T13:28:24Z
- Modified
- 2026-11-05T08:04:02Z
- Severity
-
- 4.2 (Medium) CVSS_V3 - CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L CVSS Calculator
- Summary
- Use-after-free reading `net_pkt` `iface` after send in IPv6 Neighbor Discovery (`ipv6_nbr.c`)
- Details
-
Zephyr's IPv6 Neighbor Discovery send paths (net_ipv6_send_na, net_ipv6_send_ns, net_ipv6_send_rs in subsys/net/ip/ipv6_nbr.c) updated the per-interface ICMP-sent statistics by calling net_pkt_iface(pkt) after net_send_data(pkt) had already returned successfully. On the success path the network stack owns and releases the packet's reference (the L2/driver send unrefs it, e.g. ethernet_send -> net_pkt_unref), so for a freshly allocated packet with refcount 1 the net_pkt slab block can be freed before the statistics line runs (synchronously when no TX queue thread is configured, or via a concurrent TX thread otherwise).
The subsequent net_pkt_iface(pkt) reads pkt->iface from the freed slab block, and with CONFIG_NET_STATISTICS_PER_INTERFACE enabled that loaded pointer is dereferenced to increment iface->stats.icmp.sent, a use-after-free (CWE-416). If the slab block was reallocated in the meantime the read/increment targets unrelated or attacker-influenced memory, yielding corrupted statistics, a fault/crash (denial of service), or potential limited memory corruption.
The vulnerable Neighbor Advertisement path is reachable by any unauthenticated on-link node simply by sending ICMPv6 Neighbor Solicitations to a Zephyr node with native IPv6 enabled (handle_ns_input -> net_ipv6_send_na).
Affected from v3.3.0 through v4.4.0; the fix uses the already-available iface argument instead of touching the sent packet. Configurations without per-interface statistics dereference only a global counter and are not affected by the memory-safety aspect.
- Database specific
{ "cna_assigner": "zephyr", "cwe_ids": [ "CWE-416" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/10xxx/CVE-2026-10640.json" }- References
-
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/10xxx/CVE-2026-10640.json
- https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-r74c-mr4m-7g9g
- https://nvd.nist.gov/vuln/detail/CVE-2026-10640
- https://github.com/zephyrproject-rtos/zephyr/commit/aaed8332a62b0490a2f3c2cbabe272f575068eaa
- https://github.com/zephyrproject-rtos/zephyr
Affected packages
Git / github.com/zephyrproject-rtos/zephyr
Affected ranges
- Type
- GIT
- Repo
- https://github.com/zephyrproject-rtos/zephyr
- Events
- Database specific
-
Show details
{ "extracted_events": [ { "range": [ { "introduced": "3.3.0" }, { "fixed": "4.3.1" } ], "source": "AFFECTED_FIELD", "strategy": "StandardRange" }, { "range": [ { "introduced": "4.4.0" }, { "fixed": "4.4.1" } ], "source": "AFFECTED_FIELD", "strategy": "StandardRange" }, { "range": [ { "fixed": "aaed8332a62b0490a2f3c2cbabe272f575068eaa" } ], "source": "REFERENCES_COMMIT" } ] }
Affected versions
v3.*
v4.*
zephyr-v3.*
Database specific
source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-10640.json"
vanir_signatures
[
{
"deprecated": false,
"digest": {
"line_hashes": [
"91287654074939685182679574636412394896",
"15227908928454866318017343628738582294",
"184531941854350676137052727205553850158",
"207883878984180498172001944300157653088",
"162790215008363859843239656648498494482",
"196893312463318997455331973915328240641",
"298242661318329454041778475710905117604",
"207883878984180498172001944300157653088",
"91287654074939685182679574636412394896",
"15227908928454866318017343628738582294",
"184531941854350676137052727205553850158",
"207883878984180498172001944300157653088"
],
"threshold": 0.9
},
"id": "CVE-2026-10640-16c02da8",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/zephyrproject-rtos/zephyr/commit/aaed8332a62b0490a2f3c2cbabe272f575068eaa",
"target": {
"file": "subsys/net/ip/ipv6_nbr.c"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "267183217340134069590489850874797830891",
"length": 2789
},
"id": "CVE-2026-10640-8b218a2b",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/zephyrproject-rtos/zephyr/commit/aaed8332a62b0490a2f3c2cbabe272f575068eaa",
"target": {
"file": "subsys/net/ip/ipv6_nbr.c",
"function": "net_ipv6_send_ns"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "52037421534442246379070261010880927722",
"length": 975
},
"id": "CVE-2026-10640-b402014f",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/zephyrproject-rtos/zephyr/commit/aaed8332a62b0490a2f3c2cbabe272f575068eaa",
"target": {
"file": "subsys/net/ip/ipv6_nbr.c",
"function": "net_ipv6_send_rs"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "121515546642206997958598429868473409545",
"length": 1217
},
"id": "CVE-2026-10640-bf24dde2",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/zephyrproject-rtos/zephyr/commit/aaed8332a62b0490a2f3c2cbabe272f575068eaa",
"target": {
"file": "subsys/net/ip/ipv6_nbr.c",
"function": "net_ipv6_send_na"
}
}
]
vanir_signatures_modified
"2026-11-05T08:04:02Z"