CVE-2026-15893 Zephyr IPv6 Neighbor Discovery zero reachable time from crafted Router Advertisement causes assertion/DoS

netifipv6calcreachabletime in subsys/net/ip/netif.c derives a randomized ND reachable time from ipv6-basereachabletime as minreachable + sysrand32get % maxreachable - minreachable, where minreachable = base/2 and maxreachable = 3base/2 using integer division. When basereachabletime is 1, both...

CVE-2026-10640

Zephyr's IPv6 Neighbor Discovery send paths netipv6sendna, netipv6sendns, netipv6sendrs in subsys/net/ip/ipv6nbr.c updated the per-interface ICMP-sent statistics by calling netpktifacepkt after netsenddatapkt had already returned successfully. On the success path the network stack owns and releas...

PT-2026-49713

Zephyr's IPv6 Neighbor Discovery send paths net ipv6 send na, net ipv6 send ns, net ipv6 send rs in subsys/net/ip/ipv6 nbr.c updated the per-interface ICMP-sent statistics by calling net pkt ifacepkt after net send datapkt had already returned successfully. On the success path the network stack...