4754 matches found
CVE-2026-10639 Use-after-free reading `net_pkt_iface()` of a sent ICMPv4 echo-reply packet in `icmpv4_handle_echo_request()`
In Zephyr's native IPv4 stack, icmpv4handleechorequest in subsys/net/ip/icmpv4.c builds an echo-reply packet reply, hands it to nettrysenddata, and then, on success, calls netstatsupdateicmpsentnetpktifacereply. nettrysenddata transfers ownership of reply to the TX path netiftryqueuetx - netiftx ...
CVE-2026-10638 Use-after-free in Zephyr ICMPv6 RX path when updating statistics after sending an echo reply or error
subsys/net/ip/icmpv6.c reads the network interface from a netpkt after that packet has been handed to nettrysenddata. In icmpv6handleechorequest and neticmpv6senderror, the post-send statistics update calls netpktifacereply/netpktifacepkt on the just-sent packet. The send path nettrysenddata -...
ECHO-ACFD-CCAB-2F14
Bulletin has no description...
ECHO-E0C3-0291-2960
Bulletin has no description...
ECHO-9C39-6754-F859
Bulletin has no description...
ECHO-7E50-7116-347D
Bulletin has no description...
ECHO-440F-09F3-814F
Bulletin has no description...
ECHO-A805-9C8F-03B9
Bulletin has no description...
ECHO-C86F-F4ED-54D0
Bulletin has no description...
ECHO-7B2F-B317-C281
Bulletin has no description...
ECHO-04CF-723F-CA96
Bulletin has no description...
ECHO-7056-3871-8E5D
Bulletin has no description...
ECHO-23EF-871E-3E6E
Bulletin has no description...
ECHO-6945-B95F-BADF
Bulletin has no description...
ECHO-8CC7-F811-2619
Bulletin has no description...
ECHO-1F43-E080-33E4
Bulletin has no description...
ECHO-3C70-5E98-9C5D
Bulletin has no description...
ECHO-2735-B0F7-BAB9
Bulletin has no description...