CVE-2026-12633 in Zephyr
Summary
by MITRE • 08/20/2026
The IPv6 neighbor-discovery code in subsys/net/ip/ipv6_nbr.c processes the 6LoWPAN Context Option (6CO, RFC 6775) carried inside ICMPv6 Router Advertisements. In handle_ra_6co() the 8-bit context_len field is taken directly from the packet and was never bounded to the RFC maximum of 128. The function computes context->context_len / 8 and then performs memset(context->prefix + context_len, 0, sizeof(context->prefix) - context_len), where context->prefix is a fixed 16-byte array.
With context_len between 136 and 255 (and the option length field set to 3, which the pre-fix validation accepts), context_len / 8 evaluates to 17..31, so the memset length 16 - context_len/8 underflows the unsigned size_t argument to roughly SIZE_MAX. This produces an unbounded out-of-bounds memset that zeroes kernel memory well past the 6lo context structure.
The defect is reachable from unauthenticated, link-local input: any host on the same link can send a crafted Router Advertisement with a 6CO option. The RA handler validates only the option length field before calling handle_ra_6co(), so a single packet triggers the wild write. The code is compiled when CONFIG_NET_6LO_CONTEXT is enabled.
The impact is a reliable remote (adjacent) denial of service via memory corruption, with collateral integrity loss as the memset zeroes contiguous memory before the system faults. Router Advertisements are link-scoped and not forwarded, so the attacker must be on the same link (AV:A). The fix rejects any context_len greater than 128 before the length computation.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/20/2026
The vulnerability resides in the IPv6 neighbor-discovery subsystem of Zephyr OS, specifically within the file subsys/net/ip/ipv6_nbr.c where the function handle_ra_6co processes Context Options for 6LoWPAN as defined in RFC 6775. This component is responsible for handling Router Advertisements that carry context information necessary for header compression in low-power wireless networks. The core technical flaw stems from a missing input validation check on the eight-bit context_len field extracted directly from the packet payload. According to RFC 6775, this length value must not exceed one hundred twenty-eight bits, which corresponds to sixteen bytes or twelve octets when considering the specific encoding in this implementation's logic. However, the code fails to enforce this upper bound before proceeding with memory operations based on this untrusted input.
The operational mechanism of the exploit relies on a classic integer underflow leading to an out-of-bounds write operation. The function calculates the number of bytes to zero by dividing context_len by eight and subtracting that result from the size of the fixed sixteen-byte prefix array using unsigned arithmetic. When an attacker crafts a Router Advertisement with a context_len value between one hundred thirty-six and two hundred fifty-five, the division yields a quotient ranging from seventeen to thirty-one. Subtracting this larger number from sixteen results in a large positive integer due to unsigned wrap-around, effectively converting the size argument for memset into approximately SIZE_MAX minus fifteen bytes. This causes the system to perform an unbounded memory zeroization that extends far beyond the intended context structure and into adjacent kernel memory regions.
This vulnerability is classified under CWE-190 Integer Overflow or Wraparound which directly leads to CWE-787 Out-of-bounds Write, a critical integrity violation in operating systems. From a tactical perspective, this aligns with MITRE ATT&CK technique T1499 Endpoint Denial of Service via resource exhaustion through memory corruption. The attack vector is classified as Adjacent because Router Advertisements are link-local scoped and not routed across network boundaries, requiring the attacker to be on the same local area network segment or wireless mesh. Despite this limitation, the threat level remains severe because no authentication is required for receiving these advertisements in many standard configurations, allowing any device with physical or radio proximity to trigger the flaw.
The impact of successfully exploiting this vulnerability includes a reliable denial of service condition characterized by system instability and potential kernel panic. The uncontrolled memset operation zeroes out contiguous blocks of memory containing critical data structures, control flow pointers, or other security-sensitive information before the operating system detects the illegal access and faults. This collateral integrity loss can lead to unpredictable behavior, including privilege escalation if specific heap metadata is corrupted, though primarily it results in a crash that disrupts network connectivity for all devices on the link relying on this node. The vulnerability exists only when the configuration option CONFIG_NET_6LO_CONTEXT is enabled, which limits its prevalence but does not diminish its severity within affected deployments.
Mitigation strategies must focus on enforcing strict bounds checking before any arithmetic operations involving user-controlled length fields are performed. Developers should validate that context_len does not exceed one hundred twenty-eight immediately upon extraction from the packet header, rejecting or truncating invalid options early in the processing pipeline. Additionally, implementing static analysis tools configured to detect integer underflows and out-of-bounds memory accesses during the build process can help prevent similar defects. For systems already deployed, applying vendor-provided patches that include this validation check is essential to restore security posture against local network-based denial of service attacks targeting IPv6 context management subsystems.