CVE-2026-10686

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-10686

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-10686.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-10686

Aliases

GHSA-4cg6-6jc4-2r6h

Published

2026-07-31T15:49:10.405Z

Modified

2026-08-02T09:08:23.352537Z

Severity

5.8 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L CVSS Calculator

Summary

Missing hop-limit decrement on IPv6 forwarding path allows unbounded packet looping (DoS) in Zephyr routers

Details

Zephyr's IPv6 forwarding path re-sent routed unicast packets without ever decrementing the IPv6 hop limit. Both routing branches of ipv6routepacket() (subsys/net/ip) were affected: the explicit-route path (netroutepacket()) and the on-link cross-interface path (netroutepacketif()). Each set the packet forwarding flag and called netsend_data() with the hop limit untouched and no expiry check.

Per RFC 8200 the hop-limit decrement is the mechanism that bounds packet lifetime and terminates routing loops; without it, a device acting as an IPv6 router relays looping packets indefinitely. An on-path attacker who can induce or exploit a transient L3 loop turns it into a permanent forwarding storm, causing CPU/bandwidth resource exhaustion (availability DoS) on the forwarder and adjacent links; path-discovery and loop diagnostics that rely on hop-limit expiry are also defeated.

Affected configurations. In every affected release the forwarding path is reached via CONFIGNETROUTE (enabled by default when CONFIGNETIPV6NBRCACHE is set), together with CONFIGNETROUTING for cross-interface routing. Note that CONFIGNETIPV6FORWARDING and CONFIGNETIPV4FORWARDING — which appear in the fix and in this advisory's evidence notes — were introduced after v4.4.0, when the routing options were split and renamed; they do not exist in any affected release. When auditing a v4.4.1-or-earlier configuration, look for CONFIGNETROUTE and CONFIGNETROUTING.

IPv4 is not affected in any release. The IPv4 forwarding path (netrouteipv4packet() in routeipv4.c) was added after v4.4.0 and has never shipped in a release. Its TTL decrement and IPv4 header-checksum recomputation landed on main as part of the same fix, so the evidence notes below discuss it, but no released version is reachable by way of IPv4.

Affected releases are v1.8.0 through v4.4.1: v1.8.0 introduced netroutepacket() and v2.2.0 added netroutepacket_if(), and neither decremented the hop limit. v4.3.1 carries the explicit-route fix but not the on-link one, so it is affected as well. Fixed on main by 7d8f1afa7345 (explicit-route path) and 589eadc74efa (on-link path).

Database specific

{
    "cwe_ids": [
        "CWE-835"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/10xxx/CVE-2026-10686.json",
    "cna_assigner": "zephyr",
    "unresolved_ranges": [
        {
            "source": "AFFECTED_FIELD",
            "extracted_events": [
                {
                    "introduced": "1.8.0"
                },
                {
                    "fixed": "4.5.0"
                }
            ]
        }
    ]
}

References

Affected packages

Git / github.com/zephyrproject-rtos/zephyr

Affected ranges

Type

GIT

Repo

https://github.com/zephyrproject-rtos/zephyr

Events

Introduced

fcb9144dca68f98d24caf39532595555355c3c1d

Fixed

1f6485eca25431b5ff27ce9a754218c9e559bbbb

Fixed

7d8f1afa7345975b58405d6fba18bb8c3f7cb12a

Database specific

{
    "source": [
        "DESCRIPTION",
        "REFERENCES"
    ],
    "extracted_events": [
        {
            "introduced": "v1.8.0"
        },
        {
            "fixed": "v4.4.1"
        }
    ]
}

Database specific

vanir_signatures_modified

"2026-08-02T09:08:23Z"

vanir_signatures

[
    {
        "signature_type": "Function",
        "target": {
            "file": "subsys/net/ip/ipv6.c",
            "function": "ipv6_route_packet"
        },
        "deprecated": false,
        "source": "https://github.com/zephyrproject-rtos/zephyr/commit/7d8f1afa7345975b58405d6fba18bb8c3f7cb12a",
        "id": "CVE-2026-10686-089ac25a",
        "signature_version": "v1",
        "digest": {
            "function_hash": "149161721635414718532030476832712545230",
            "length": 1513.0
        }
    },
    {
        "signature_type": "Function",
        "target": {
            "file": "subsys/net/ip/route.c",
            "function": "net_route_packet_if"
        },
        "deprecated": false,
        "source": "https://github.com/zephyrproject-rtos/zephyr/commit/7d8f1afa7345975b58405d6fba18bb8c3f7cb12a",
        "id": "CVE-2026-10686-0c0c2423",
        "signature_version": "v1",
        "digest": {
            "function_hash": "329030818810032849640309194668694954253",
            "length": 422.0
        }
    },
    {
        "signature_type": "Line",
        "target": {
            "file": "subsys/net/ip/ipv4.c"
        },
        "deprecated": false,
        "source": "https://github.com/zephyrproject-rtos/zephyr/commit/7d8f1afa7345975b58405d6fba18bb8c3f7cb12a",
        "id": "CVE-2026-10686-10d3c2d0",
        "signature_version": "v1",
        "digest": {
            "line_hashes": [
                "205983342471851734749687782421704907794",
                "286879810404454470734698222007887290203",
                "157225663500625135204252728883999689988"
            ],
            "threshold": 0.9
        }
    },
    {
        "signature_type": "Line",
        "target": {
            "file": "subsys/net/ip/ipv6.c"
        },
        "deprecated": false,
        "source": "https://github.com/zephyrproject-rtos/zephyr/commit/7d8f1afa7345975b58405d6fba18bb8c3f7cb12a",
        "id": "CVE-2026-10686-39b85038",
        "signature_version": "v1",
        "digest": {
            "line_hashes": [
                "161285132624229514695039641542266971394",
                "97145227554893536734459617435120568182",
                "206688593541347446449599360304353318828"
            ],
            "threshold": 0.9
        }
    },
    {
        "signature_type": "Function",
        "target": {
            "file": "subsys/net/ip/route_ipv6.c",
            "function": "net_route_ipv6_packet"
        },
        "deprecated": false,
        "source": "https://github.com/zephyrproject-rtos/zephyr/commit/7d8f1afa7345975b58405d6fba18bb8c3f7cb12a",
        "id": "CVE-2026-10686-3b9aac3a",
        "signature_version": "v1",
        "digest": {
            "function_hash": "36671954607865498698836366770749743164",
            "length": 1204.0
        }
    },
    {
        "signature_type": "Line",
        "target": {
            "file": "subsys/net/ip/route_ipv4.c"
        },
        "deprecated": false,
        "source": "https://github.com/zephyrproject-rtos/zephyr/commit/7d8f1afa7345975b58405d6fba18bb8c3f7cb12a",
        "id": "CVE-2026-10686-436679f1",
        "signature_version": "v1",
        "digest": {
            "line_hashes": [
                "211858005811010295637392297542816776260",
                "148787932673448282944304714172139058456",
                "303353423130818383648083104289068056017",
                "25372112909369624967735681874067258858"
            ],
            "threshold": 0.9
        }
    },
    {
        "signature_type": "Line",
        "target": {
            "file": "subsys/net/ip/route_ipv6.c"
        },
        "deprecated": false,
        "source": "https://github.com/zephyrproject-rtos/zephyr/commit/7d8f1afa7345975b58405d6fba18bb8c3f7cb12a",
        "id": "CVE-2026-10686-4c6c4c79",
        "signature_version": "v1",
        "digest": {
            "line_hashes": [
                "266190140630791131732203826095923220111",
                "181312333510636950074171158761433240595",
                "216565715219510944389297858112334225423",
                "137512365386111797585320410336938348489",
                "31941448771653703163848559934541858193",
                "137207442670245716864648000696915371238",
                "138352856089512520288572173206435346230",
                "117697875171740803164832991957739704739",
                "269035025708167450161860708074538971272",
                "288889341593362343781858734477143938551",
                "88351026886140322124508838203769493784",
                "60505181589675543256911362497118706021",
                "101384683334453129768529902344075132566",
                "307754704864305477580489509636147145015",
                "68366218848598354933489468238364048435",
                "265620160235324948503512118226596090177",
                "88798094875053445886583579137144546754"
            ],
            "threshold": 0.9
        }
    },
    {
        "signature_type": "Function",
        "target": {
            "file": "subsys/net/ip/ipv4.c",
            "function": "ipv4_route_packet"
        },
        "deprecated": false,
        "source": "https://github.com/zephyrproject-rtos/zephyr/commit/7d8f1afa7345975b58405d6fba18bb8c3f7cb12a",
        "id": "CVE-2026-10686-8cda0ef7",
        "signature_version": "v1",
        "digest": {
            "function_hash": "274718251614380039133973868492851179899",
            "length": 906.0
        }
    },
    {
        "signature_type": "Line",
        "target": {
            "file": "subsys/net/ip/route.c"
        },
        "deprecated": false,
        "source": "https://github.com/zephyrproject-rtos/zephyr/commit/7d8f1afa7345975b58405d6fba18bb8c3f7cb12a",
        "id": "CVE-2026-10686-909ff82a",
        "signature_version": "v1",
        "digest": {
            "line_hashes": [
                "238779661816436845821826744722431474197",
                "283517622018266941826682608108639278775",
                "145164056549871633577869602115784709160",
                "318352358882996420118678134327101428861",
                "123346784010710329182335547399986452936",
                "307333214105470923730753282369509948998",
                "296599060822067726812666044680245326202"
            ],
            "threshold": 0.9
        }
    },
    {
        "signature_type": "Function",
        "target": {
            "file": "subsys/net/ip/route_ipv4.c",
            "function": "net_route_ipv4_packet"
        },
        "deprecated": false,
        "source": "https://github.com/zephyrproject-rtos/zephyr/commit/7d8f1afa7345975b58405d6fba18bb8c3f7cb12a",
        "id": "CVE-2026-10686-b3236e54",
        "signature_version": "v1",
        "digest": {
            "function_hash": "258826021568808342861616053905195599949",
            "length": 385.0
        }
    },
    {
        "signature_type": "Function",
        "target": {
            "file": "subsys/net/ip/route_ipv6.c",
            "function": "net_route_ipv6_mcast_forward_packet"
        },
        "deprecated": false,
        "source": "https://github.com/zephyrproject-rtos/zephyr/commit/7d8f1afa7345975b58405d6fba18bb8c3f7cb12a",
        "id": "CVE-2026-10686-fb7abca7",
        "signature_version": "v1",
        "digest": {
            "function_hash": "219100806673568323706506403534576170915",
            "length": 811.0
        }
    }
]

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-10686.json"