30 matches found
UBUNTU-CVE-2026-79981
The DNS stub resolver in subsys/net/lib/dns/resolve.c binds one UDP socket per configured server when the resolver context is initialised dnsresolveinitlocked - registerdispatcher - dnsdispatcherregister, with the local port left at 0 so the stack picks an ephemeral port exactly once. dnswrite th...
CVE-2026-19577
netrouteipv6packet in subsys/net/ip/routeipv6.c resolved the nexthop's link-layer address with netnbrgetlladdrnbr-idx without first checking whether the neighbor cache entry actually had a linked link-layer address. An unresolved neighbor carries idx == NETNBRLLADDRUNKNOWN 0xff, and netnbrgetllad...
CVE-2026-19735
The RFC 6528 initial-sequence-number implementation in subsys/net/ip/tcp.c derived every TCP ISN from SHA-256uniquekey || four-tuple plus a uptime-derived offset, where uniquekey is a 128-bit secret filled once by syscsrandget. The return value of that call was discarded and the once guard was...
EUVD-2026-97114
The RFC 6528 initial-sequence-number implementation in subsys/net/ip/tcp.c derived every TCP ISN from SHA-256uniquekey || four-tuple plus a uptime-derived offset, where uniquekey is a 128-bit secret filled once by syscsrandget. The return value of that call was discarded and the once guard was...
CVE-2026-19735 Predictable TCP initial sequence numbers when the RFC 6528 secret key generation fails silently in the Zephyr TCP stack
The RFC 6528 initial-sequence-number implementation in subsys/net/ip/tcp.c derived every TCP ISN from SHA-256uniquekey || four-tuple plus a uptime-derived offset, where uniquekey is a 128-bit secret filled once by syscsrandget. The return value of that call was discarded and the once guard was...
CVE-2026-19735 Predictable TCP initial sequence numbers when the RFC 6528 secret key generation fails silently in the Zephyr TCP stack
The RFC 6528 initial-sequence-number implementation in subsys/net/ip/tcp.c derived every TCP ISN from SHA-256uniquekey || four-tuple plus a uptime-derived offset, where uniquekey is a 128-bit secret filled once by syscsrandget. The return value of that call was discarded and the once guard was...
CVE-2026-19735
The Zephyr TCP stack contains a vulnerability where the RFC 6528 initial-sequence-number (ISN) implementation may use predictable values. If the sys_csrand_get() call fails during early boot (e.g., due to -ENODEV or -EIO from the entropy driver), the system fails to catch the error and leaves the...
CVE-2026-19735
The RFC 6528 initial-sequence-number implementation in subsys/net/ip/tcp.c derived every TCP ISN from SHA-256uniquekey || four-tuple plus a uptime-derived offset, where uniquekey is a 128-bit secret filled once by syscsrandget. The return value of that call was discarded and the once guard was...
CVE-2026-19735 Predictable TCP initial sequence numbers when the RFC 6528 secret key generation fails silently in the Zephyr TCP stack
The RFC 6528 initial-sequence-number implementation in subsys/net/ip/tcp.c derived every TCP ISN from SHA-256uniquekey || four-tuple plus a uptime-derived offset, where uniquekey is a 128-bit secret filled once by syscsrandget. The return value of that call was discarded and the once guard was...
CVE-2026-19577 Out-of-bounds read in IPv6 route forwarding when the nexthop neighbor has no link-layer address
netrouteipv6packet in subsys/net/ip/routeipv6.c resolved the nexthop's link-layer address with netnbrgetlladdrnbr-idx without first checking whether the neighbor cache entry actually had a linked link-layer address. An unresolved neighbor carries idx == NETNBRLLADDRUNKNOWN 0xff, and netnbrgetllad...
CVE-2026-19577: Out-of-bounds Read
netrouteipv6packet in subsys/net/ip/routeipv6.c resolved the nexthop's link-layer address with netnbrgetlladdrnbr-idx without first checking whether the neighbor cache entry actually had a linked link-layer address. An unresolved neighbor carries idx == NETNBRLLADDRUNKNOWN 0xff, and netnbrgetllad...
PT-2026-110222
Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description An issue exists in the RFC 6528 initial-sequence-number ISN implementation within subsys/net/ip/tcp.c. The system derives the TCP ISN using a 128-bit secret uniq...
CVE-2026-19735: Use of Insufficiently Random Values
The RFC 6528 initial-sequence-number implementation in subsys/net/ip/tcp.c derived every TCP ISN from SHA-256uniquekey || four-tuple plus a uptime-derived offset, where uniquekey is a 128-bit secret filled once by syscsrandget. The return value of that call was discarded and the once guard was...
PT-2026-110220
net route ipv6 packet in subsys/net/ip/route ipv6.c resolved the nexthop's link-layer address with net nbr get lladdrnbr-idx without first checking whether the neighbor cache entry actually had a linked link-layer address. An unresolved neighbor carries idx == NET NBR LLADDR UNKNOWN 0xff, and net...
CVE-2026-18417
The native BSD-socket layer recorded a pending asynchronous socket error by type-punning it into struct netcontext's void userdata field ctx-userdata = INTTOPOINTER-status in zsockacceptedcb, zsockreceivedcb, zsockconnectedcb and zsockclosectx in subsys/net/lib/sockets/socketsinet.c, reading it...
CVE-2026-16515 ICMPv6 error messages sent for multicast-destined packets and non-unique source addresses enable network amplification in Zephyr's IPv6 stack
neticmpv6senderror in subsys/net/ip/icmpv6.c implemented only one of the three RFC 4443 section 2.4 suppression rules do not answer an ICMPv6 error with an ICMPv6 error. It did not check whether the triggering packet's source address identifies a single node rule e.6 or whether the packet was sen...
PT-2026-95410
Name of the Vulnerable Software and Affected Versions Zephyr affected versions not specified Description The net icmpv6 send error function in subsys/net/ip/icmpv6.c fails to implement all RFC 4443 section 2.4 suppression rules, which dictate that an ICMPv6 error should not be answered with anoth...
CVE-2026-16515: Insufficient Control of Network Message Volume (Network Amplification)
neticmpv6senderror in subsys/net/ip/icmpv6.c implemented only one of the three RFC 4443 section 2.4 suppression rules do not answer an ICMPv6 error with an ICMPv6 error. It did not check whether the triggering packet's source address identifies a single node rule e.6 or whether the packet was sen...
CVE-2026-15893: Reachable Assertion
netifipv6calcreachabletime in subsys/net/ip/netif.c derives a randomized ND reachable time from ipv6-basereachabletime as minreachable + sysrand32get % maxreachable - minreachable, where minreachable = base/2 and maxreachable = 3base/2 using integer division. When basereachabletime is 1, both...
CVE-2026-12633
The IPv6 neighbor-discovery code in subsys/net/ip/ipv6nbr.c processes the 6LoWPAN Context Option 6CO, RFC 6775 carried inside ICMPv6 Router Advertisements. In handlera6co the 8-bit contextlen field is taken directly from the packet and was never bounded to the RFC maximum of 128. The function...