CVE-2026-126957

An integer underflow in Zephyr's IPv4 option handling allows a remote, unauthenticated attacker to read stack memory. When replying to an ICMP Echo Request that carries an IPv4 Record Route or Timestamp option, icmpv4updaterecordroute and icmpv4updatetimestamp in subsys/net/ip/icmpv4.c compute th...