6071 matches found
CVE-2026-10639 Use-after-free reading `net_pkt_iface()` of a sent ICMPv4 echo-reply packet in `icmpv4_handle_echo_request()`
In Zephyr's native IPv4 stack, icmpv4handleechorequest in subsys/net/ip/icmpv4.c builds an echo-reply packet reply, hands it to nettrysenddata, and then, on success, calls netstatsupdateicmpsentnetpktifacereply. nettrysenddata transfers ownership of reply to the TX path netiftryqueuetx - netiftx ...
CVE-2026-10638 Use-after-free in Zephyr ICMPv6 RX path when updating statistics after sending an echo reply or error
subsys/net/ip/icmpv6.c reads the network interface from a netpkt after that packet has been handed to nettrysenddata. In icmpv6handleechorequest and neticmpv6senderror, the post-send statistics update calls netpktifacereply/netpktifacepkt on the just-sent packet. The send path nettrysenddata -...
CVE-2026-10638: Use After Free
subsys/net/ip/icmpv6.c reads the network interface from a netpkt after that packet has been handed to nettrysenddata. In icmpv6handleechorequest and neticmpv6senderror, the post-send statistics update calls netpktifacereply/netpktifacepkt on the just-sent packet. The send path nettrysenddata -...
PT-2026-49712
Name of the Vulnerable Software and Affected Versions Zephyr versions 1.14 through 4.4.0 Description A use-after-free issue exists in the native IPv4 stack within the icmpv4 handle echo request function in subsys/net/ip/icmpv4.c. The function creates an echo-reply packet and passes it to net try...
ECHO-ACFD-CCAB-2F14
Bulletin has no description...
ECHO-7E50-7116-347D
Bulletin has no description...
ECHO-0CDD-0672-ABD7
Bulletin has no description...
ECHO-8CC7-F811-2619
Bulletin has no description...
ECHO-7056-3871-8E5D
Bulletin has no description...
ECHO-2735-B0F7-BAB9
Bulletin has no description...
ECHO-9176-8EAC-4D46
Bulletin has no description...
ECHO-6945-B95F-BADF
Bulletin has no description...
ECHO-1F43-E080-33E4
Bulletin has no description...
ECHO-C86F-F4ED-54D0
Bulletin has no description...
ECHO-9C39-6754-F859
Bulletin has no description...
ECHO-CD52-AAD2-2B33
Bulletin has no description...
ECHO-E0C3-0291-2960
Bulletin has no description...
ECHO-04CF-723F-CA96
Bulletin has no description...