PT-2026-49713 · Zephyr · Zephyr

CVE-2026-10640 · Published 2026-06-16 · Updated 2026-06-16

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

Name of the Vulnerable Software and Affected Versions Zephyr versions 3.3.0 through 4.4.0

Description Use-after-free occurs in the IPv6 Neighbor Discovery send paths within the functions net ipv6 send na(), net ipv6 send ns(), and net ipv6 send rs(). The issue arises when the system updates per-interface ICMP-sent statistics by calling net pkt iface(pkt) after net send data(pkt) has already released the packet's reference. If the network slab block is freed before the statistics are updated, the system dereferences a freed pointer to increment iface-stats.icmp.sent. This can lead to corrupted statistics, a system crash causing denial of service, or limited memory corruption. The vulnerable Neighbor Advertisement path can be triggered by any unauthenticated on-link node by sending ICMPv6 Neighbor Solicitations to a node with native IPv6 enabled via handle ns input and net ipv6 send na().

Recommendations Update Zephyr versions 3.3.0 through 4.4.0 to a version where the iface argument is used instead of the sent packet for statistics updates.

Exploit

Fix

DoS

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

CVE-2026-10640

GHSA-R74C-MR4M-7G9G

Affected Products

Zephyr

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/10xxx/CVE-2026-10640.json · Exploit
• https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-r74c-mr4m-7g9g · Vendor Advisory
• https://github.com/zephyrproject-rtos/zephyr/commit/aaed8332a62b0490a2f3c2cbabe272f575068eaa · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-10640 · Security Note
• https://osv.dev/vulnerability/CVE-2026-10640 · Vendor Advisory
• https://github.com/zephyrproject-rtos/zephyr · Note
• https://t.me/CVEtracker/57001 · Telegram Post
• https://twitter.com/CVEnew/status/2066980913528082911 · Twitter Post