{"id":"CVE-2026-10637","summary":"Use-after-free of `net_pkt` in IPv6 MLD send path triggerable by a link-local MLD Query","details":"subsys/net/ip/ipv6_mld.c:mld_send() read the packet interface via net_pkt_iface(pkt) after net_send_data(pkt) returned successfully. Per the network stack's ownership contract (include/zephyr/net/net_core.h, and the explicit warning in subsys/net/ip/net_core.c:453-460 'do not use pkt after that call'), a successful send transfers ownership of the net_pkt and the L2 driver frees it (e.g. ethernet_send() unrefs the packet on success, subsys/net/l2/ethernet/ethernet.c:790), returning it to its k_mem_slab.\n\nThe subsequent net_pkt_iface(pkt) is therefore a read of a freed object; the recovered interface pointer is then dereferenced and incremented by the per-interface statistics path (net_stats.h UPDATE_STAT/SET_STAT) when CONFIG_NET_STATISTICS_PER_INTERFACE is enabled. If the freed slot is concurrently reallocated, pkt-\u003eiface may read back as NULL (NULL-pointer dereference / crash) or as a stale/garbage pointer (stray increment write / memory corruption).\n\nThe path is reachable remotely on the local link without authentication: handle_mld_query() (registered for NET_ICMPV6_MLD_QUERY) responds to a valid MLDv2 General Query (unspecified multicast address, hop limit 1) by calling send_mld_report() -\u003e mld_send().\n\nThe result is a remotely triggerable denial of service of the networking stack, with a narrow possibility of memory corruption. The fix caches the interface in a local before sending and no longer touches the packet after net_send_data(). The IPv4/IGMP sibling (igmp_send) already used the corrected pattern.","aliases":["GHSA-m23w-34pp-4h92"],"modified":"2026-10-21T09:38:09.768223581Z","published":"2026-06-16T13:13:16.034Z","database_specific":{"cna_assigner":"zephyr","cwe_ids":["CWE-416"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/10xxx/CVE-2026-10637.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/10xxx/CVE-2026-10637.json"},{"type":"ADVISORY","url":"https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-m23w-34pp-4h92"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-10637"},{"type":"FIX","url":"https://github.com/zephyrproject-rtos/zephyr/commit/3159c53e8e7d233c2a85a0798cf25ac441db6dae"},{"type":"PACKAGE","url":"https://github.com/zephyrproject-rtos/zephyr"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/zephyrproject-rtos/zephyr","events":[{"introduced":"f58d9caba242e52a4e0150dd1be0c99e239a9d42"},{"fixed":"75f67d766726351b30199f9a2bf55803d717a3be"},{"introduced":"684c9e8f32e4373a21098559f748f06915f950c9"},{"fixed":"1f6485eca25431b5ff27ce9a754218c9e559bbbb"},{"fixed":"3159c53e8e7d233c2a85a0798cf25ac441db6dae"}],"database_specific":{"extracted_events":[{"source":"AFFECTED_FIELD","strategy":"StandardRange","range":[{"introduced":"1.12.0"},{"fixed":"4.3.1"}]},{"source":"AFFECTED_FIELD","strategy":"StandardRange","range":[{"introduced":"4.4.0"},{"fixed":"4.4.1"}]},{"range":[{"fixed":"3159c53e8e7d233c2a85a0798cf25ac441db6dae"}],"source":"REFERENCES_COMMIT"}]}}],"versions":["v4.3.1-rc1","v4.4.1-rc1","v4.4.0","v4.3.0","v4.3.0-rc3","v4.3.0-rc2","v4.3.0-rc1","v4.2.0","v4.2.0-rc3","v4.2.0-rc2","v4.2.0-rc1","v4.1.0","v4.1.0-rc3","v4.1.0-rc2","v4.1.0-rc1","v4.0.0","v4.0.0-rc3","v4.0.0-rc2","v4.0.0-rc1","v3.7.0","v3.7.0-rc3","v3.7.0-rc2","v3.7.0-rc1","v3.6.0","v3.6.0-rc3","v3.6.0-rc2","v3.6.0-rc1","zephyr-v3.5.0","v3.5.0","v3.5.0-rc3","v3.5.0-rc2","v3.5.0-rc1","zephyr-v3.4.0","v3.4.0","v3.4.0-rc3","v3.4.0-rc2","v3.4.0-rc1","zephyr-v3.3.0","v3.3.0","v3.3.0-rc3","v3.3.0-rc2","v3.3.0-rc1","zephyr-v3.2.0","v3.2.0","v3.2.0-rc3","v3.2.0-rc2","v3.2.0-rc1","zephyr-v3.1.0","v3.1.0","v3.1.0-rc3","v3.1.0-rc2","v3.1.0-rc1","zephyr-v3.0.0","v3.0.0","v3.0.0-rc3","v3.0.0-rc2","v3.0.0-rc1","v2.7.99","v2.7.0-rc3","v2.7.0-rc2","v2.7.0-rc1","zephyr-v2.6.0","v2.6.0","v2.6.0-rc3","v2.6.0-rc2","v2.6.0-rc1","zephyr-v2.5.0","v2.5.0","v2.5.0-rc4","v2.5.0-rc3","v2.5.0-rc2","v2.5.0-rc1","zephyr-v2.4.0","v2.4.0","v2.4.0-rc3","v2.4.0-rc2","v2.4.0-rc1","zephyr-v2.3.0","v2.3.0","v2.3.0-rc2","v2.3.0-rc1","zephyr-v2.1.0","v2.1.0","zephyr-v2.2.0","v2.2.0","v2.2.0-rc3","v2.2.0-rc2","v2.2.0-rc1","v2.1.0-rc3","v2.1.0-rc2","v2.1.0-rc1","zephyr-v2.0.0","v2.0.0","v2.0.0-rc3","v2.0.0-rc2","v2.0.0-rc1","zephyr-v1.14.0","v1.14.0","v1.14.0-rc3","v1.14.0-rc2","v1.14.0-rc1","zephyr-v1.13.0","v1.13.0","v1.13.0-rc3","v1.13.0-rc2","v1.13.0-rc1","zephyr-v1.12.0","v1.12.0"],"database_specific":{"vanir_signatures":[{"source":"https://github.com/zephyrproject-rtos/zephyr/commit/3159c53e8e7d233c2a85a0798cf25ac441db6dae","target":{"file":"subsys/net/ip/ipv6_mld.c","function":"mld_send"},"deprecated":false,"digest":{"function_hash":"144680731799104571886597726209930301761","length":345},"id":"CVE-2026-10637-8e72948d","signature_type":"Function","signature_version":"v1"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/zephyrproject-rtos/zephyr/commit/3159c53e8e7d233c2a85a0798cf25ac441db6dae","target":{"file":"subsys/net/ip/ipv6_mld.c"},"deprecated":false,"digest":{"line_hashes":["141080271607824276946141784652751936007","178665497896208158346592190385085511154","102501487806688596980775988094189277250","37627745746268865728390725292390920281","272824570300184854606201293376216535782","127594452236699840214104284704839748240","109602479534069600659485777729358594123","1437313042469205058993842840521283714","3154321556375386285679894176153811236","214335564176519044197789802125695498972","239137202910042472469725396291196115581","76056255299466034745421127401838544639","95219698899571549057890082437194147367","28882126505266844521344428504456967536"],"threshold":0.9},"id":"CVE-2026-10637-efcb5eff"}],"vanir_signatures_modified":"2026-10-21T09:38:09Z","source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-10637.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H"}]}