CVE-2026-10637

{
  "id": "CVE-2026-10637",
  "sourceIdentifier": "[email protected]",
  "published": "2026-06-16T15:16:33.987",
  "lastModified": "2026-10-26T12:10:00.130",
  "vulnStatus": "Modified",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "subsys/net/ip/ipv6_mld.c:mld_send() read the packet interface via net_pkt_iface(pkt) after net_send_data(pkt) returned successfully. Per the network stack's ownership contract (include/zephyr/net/net_core.h, and the explicit warning in subsys/net/ip/net_core.c:453-460 'do not use pkt after that call'), a successful send transfers ownership of the net_pkt and the L2 driver frees it (e.g. ethernet_send() unrefs the packet on success, subsys/net/l2/ethernet/ethernet.c:790), returning it to its k_mem_slab.\n\nThe subsequent net_pkt_iface(pkt) is therefore a read of a freed object; the recovered interface pointer is then dereferenced and incremented by the per-interface statistics path (net_stats.h UPDATE_STAT/SET_STAT) when CONFIG_NET_STATISTICS_PER_INTERFACE is enabled. If the freed slot is concurrently reallocated, pkt->iface may read back as NULL (NULL-pointer dereference / crash) or as a stale/garbage pointer (stray increment write / memory corruption).\n\nThe path is reachable remotely on the local link without authentication: handle_mld_query() (registered for NET_ICMPV6_MLD_QUERY) responds to a valid MLDv2 General Query (unspecified multicast address, hop limit 1) by calling send_mld_report() -> mld_send().\n\nThe result is a remotely triggerable denial of service of the networking stack, with a narrow possibility of memory corruption. The fix caches the interface in a local before sending and no longer touches the packet after net_send_data(). The IPv4/IGMP sibling (igmp_send) already used the corrected pattern."
    },
    {
      "lang": "es",
      "value": "subsys/net/ip/ipv6_mld.c:mld_send() leyó la interfaz del paquete a través de net_pkt_iface(pkt) después de que net_send_data(pkt) regresara exitosamente. Según el contrato de propiedad de la pila de red (include/zephyr/net/net_core.h, y la advertencia explícita en subsys/net/ip/net_core.c:453-460 ’do not use pkt after that call’), un envío exitoso transfiere la propiedad del net_pkt y el controlador L2 lo libera (por ejemplo, ethernet_send() desreferencia el paquete al tener éxito, subsys/net/l2/ethernet/ethernet.c:790), devolviéndolo a su k_mem_slab. El subsiguiente net_pkt_iface(pkt) es, por lo tanto, una lectura de un objeto liberado; el puntero de interfaz recuperado es luego desreferenciado e incrementado por la ruta de estadísticas por interfaz (net_stats.h UPDATE_STAT/SET_STAT) cuando CONFIG_NET_STATISTICS_PER_INTERFACE está habilitado. Si el slot liberado es reasignado concurrentemente, pkt-iface puede leerse como NULL (desreferencia de puntero NULL / caída) o como un puntero obsoleto/basura (escritura de incremento errante / corrupción de memoria). La ruta es alcanzable remotamente en el enlace local sin autenticación: handle_mld_query() (registrado para NET_ICMPV6_MLD_QUERY) responde a una consulta general MLDv2 válida (dirección de multidifusión no especificada, límite de salto 1) llamando a send_mld_report() - mld_send(). El resultado es una denegación de servicio de la pila de red que puede ser activada remotamente, con una estrecha posibilidad de corrupción de memoria. La solución almacena en caché la interfaz en una variable local antes de enviar y ya no toca el paquete después de net_send_data(). El hermano IPv4/IGMP (igmp_send) ya utilizaba el patrón corregido."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "zephyrproject",
          "product": "zephyr",
          "defaultStatus": "unaffected",
          "collectionURL": "https://github.com/zephyrproject-rtos/zephyr",
          "packageName": "zephyr",
          "programFiles": [
            "subsys/net/ip/ipv6_mld.c"
          ],
          "versions": [
            {
              "version": "1.12.0",
              "lessThan": "4.3.1",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "4.4.0",
              "lessThan": "4.4.1",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H",
          "baseScore": 5.9,
          "baseSeverity": "MEDIUM",
          "attackVector": "ADJACENT_NETWORK",
          "attackComplexity": "HIGH",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "LOW",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 1.6,
        "impactScore": 4.2
      },
      {
        "source": "[email protected]",
        "type": "Primary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H",
          "baseScore": 7.1,
          "baseSeverity": "HIGH",
          "attackVector": "ADJACENT_NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "LOW",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 4.2
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-06-16T15:30:13.376607Z",
          "id": "CVE-2026-10637",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-416"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:zephyrproject:zephyr:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "1.12.0",
              "versionEndExcluding": "4.5.0",
              "matchCriteriaId": "E03B5738-05F2-483A-8CC1-97F83A729DE2"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/zephyrproject-rtos/zephyr/commit/3159c53e8e7d233c2a85a0798cf25ac441db6dae",
      "source": "[email protected]",
      "tags": [
        "Patch"
      ]
    },
    {
      "url": "https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-m23w-34pp-4h92",
      "source": "[email protected]",
      "tags": [
        "Exploit",
        "Patch",
        "Vendor Advisory"
      ]
    }
  ]
}