CVE-2026-19577 in Zephyr
Summary
by MITRE • 10/11/2026
net_route_ipv6_packet() in subsys/net/ip/route_ipv6.c resolved the nexthop's link-layer address with net_nbr_get_lladdr(nbr->idx) without first checking whether the neighbor cache entry actually had a linked link-layer address. An unresolved neighbor carries idx == NET_NBR_LLADDR_UNKNOWN (0xff), and net_nbr_get_lladdr() in subsys/net/ip/nbr.c performs no runtime bounds check beyond a NET_ASSERT, returning &net_neighbor_lladdr[255] — roughly 2.5 KB past the end of an array whose default size is CONFIG_NET_IPV6_MAX_NEIGHBORS (8). Because the returned pointer is never NULL, the following lladdr == NULL guard does not catch it.
The function is reached from ipv6_route_packet() in subsys/net/ip/ipv6.c for every received unicast IPv6 packet whose destination is not a local address on the receiving interface; CONFIG_NET_IPV6_ROUTE is enabled by default whenever the IPv6 neighbor cache is, so no router or forwarding configuration is needed. net_route_ipv6_get_info() returns the packet's destination itself as the nexthop when a neighbor cache entry for it exists, and the cache lookup does not skip INCOMPLETE entries. An unauthenticated attacker on the same link can therefore force the unresolved state — for example by eliciting traffic to a spoofed, non-existent neighbor address so that net_ipv6_send_ns() creates an INCOMPLETE entry, or by sending a Router Advertisement with no source link-layer address option, which creates a persistently unresolved router neighbor — and then send a packet addressed to that neighbor.
The result is an out-of-bounds read at a fixed index past the neighbor link-layer address array. On builds with CONFIG_ASSERT enabled the assertion fires and the device panics, giving a repeatable remote denial of service. With assertions disabled, the stale out-of-bounds struct net_linkaddr drives a memcmp() over an attacker-uninfluenced length and, when its len byte passes the NET_LINK_ADDR_MAX_LENGTH check, up to 8 bytes of unrelated static RAM are copied into the outgoing frame's destination link-layer address and transmitted on the link, disclosing them to any listener. There is no out-of-bounds write and the offset is not attacker-controlled, which bounds the impact.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/11/2026
The vulnerability resides in the net_route_ipv6_packet function within the Zephyr RTOS networking stack, specifically affecting IPv6 packet routing logic when neighbor resolution is incomplete or unresolved. The core technical flaw stems from a missing validation check before accessing link-layer address data structures. When processing an unicast IPv6 packet destined for a non-local address, the system attempts to resolve the next-hop's link-layer address by calling net_nbr_get_lladdr with the index of the corresponding neighbor cache entry. However, this function is invoked without first verifying whether the neighbor cache entry has successfully resolved its layer-2 address. In scenarios where the neighbor state remains unresolved, such as INCOMPLETE or FAILED states, the internal index value corresponds to NET_NBR_LLADDR_UNKNOWN, which is defined as 0xff or 255 in decimal.
The net_nbr_get_lladdr function relies on a static array of link-layer addresses sized according to CONFIG_NET_IPV6_MAX_NEIGHBORS, which defaults to eight entries. Because the function lacks runtime bounds checking beyond an optional assertion macro, it blindly accesses index 255 of this small array. This results in reading memory approximately two and a half kilobytes past the end of the intended data structure. The returned pointer is never NULL because it points into valid but unintended static RAM regions rather than indicating a null reference. Consequently, subsequent code that checks for a NULL destination link-layer address fails to detect this invalid state, allowing the corrupted or stale memory content to be processed further in the packet transmission pipeline.
This vulnerability can be triggered remotely by an attacker on the same local network segment without requiring authentication or specific router configuration. The IPv6 routing logic is enabled by default whenever neighbor cache support is active, meaning no special forwarding setup is necessary for exploitation. An attacker can force a neighbor entry into an unresolved state through various methods. One approach involves sending traffic to a spoofed, non-existent IPv6 address, which triggers the Neighbor Solicitation mechanism and creates an INCOMPLETE cache entry that never resolves because no response is received from the fake target. Another method involves sending Router Advertisements that lack source link-layer address options, causing the system to create persistently unresolved router neighbor entries. Once such an unresolved entry exists, any subsequent packet directed toward that destination will trigger the out-of-bounds read during routing processing.
The operational impact of this vulnerability manifests in two distinct ways depending on the build configuration and runtime environment. When assertions are enabled via CONFIG_ASSERT, the invalid memory access triggers a fatal assertion failure, resulting in an immediate device panic or reboot. This provides a reliable remote denial of service vector that can disrupt network availability for all devices relying on the compromised router or host. In configurations where assertions are disabled to optimize performance or reduce overhead, the system continues execution despite the corrupted data. The stale out-of-bounds struct net_linkaddr is then passed to a memcmp operation and subsequently copied into the outgoing frame's destination link-layer address field if its length byte passes validation checks. This results in an information disclosure vulnerability where up to eight bytes of unrelated static RAM content are transmitted on the local network segment, potentially exposing sensitive internal state or cryptographic material to any passive listener on the wire.
From a classification perspective, this issue aligns with CWE-125 Out-of-bounds Read and CWE-787 Out-of-bounds Write in its potential for memory corruption if the offset were attacker-controlled, though here it is fixed. The exploitation technique relates to ATT&CK T1499 Endpoint Denial of Service via resource exhaustion or crash induction, as well as ATT&CK T1056 Input Capture for keylogging and credential theft if sensitive data is leaked over the network. Mitigation strategies should prioritize applying vendor-provided patches that introduce explicit bounds checking before accessing neighbor cache entries by index. Developers must ensure that net_nbr_get_lladdr validates the input index against the maximum number of configured neighbors before array access. Additionally, enabling CONFIG_ASSERT in production environments where feasible can provide an early warning mechanism for such logic errors through controlled crashes rather than silent data leakage. Network segmentation and monitoring tools should also be employed to detect anomalous traffic patterns indicative of neighbor cache poisoning attempts or unusual link-layer address fields in outgoing frames.