CVE-2026-12630

Zephyr's 6LoWPAN IP Header Compression (IPHC) uncompression code contains an out-of-bounds read in getihpcinlinedsize() (subsys/net/ip/6lo.c). The destination inline size is looked up in dainlinesizetable, which has 13 entries, using an index built from the M, DAC and DAM bits of the received IPHC dispatch word (iphc & NET6LOIPHCDAMASK, a 4-bit value of 0-15). The reserved combinations 13, 14 and 15 are not bounds-checked and read past the end of the table.

The iphc word is taken directly from the received frame, and getihpcinlinedsize() is reached on every inbound 6LoWPAN frame via net6louncompress() from the 802.15.4 receive path (subsys/net/l2/ieee802154/ieee8021546lo.c and ieee8021546lofragment.c). An unauthenticated attacker on the radio/adjacent link can therefore craft a frame whose destination addressing-mode nibble selects an out-of-range index, with no privileges or user interaction.

The out-of-bounds value becomes the computed inlinesize, which then drives header reconstruction before the buffer-length check: it is used to dereference *(pkt->buffer->data + sizeof(iphc) + inlinesize) and to compute a size_t diff that can underflow, leading to a further out-of-bounds read of the packet buffer and malformed uncompression. The practical impact is a radio-triggerable out-of-bounds read / denial-of-service on the receiver; the leaked byte is not returned to the attacker. The fix rejects any destination index beyond the table, aborting processing of the malformed frame.