PT-2026-53753 · Zephyr · Zephyr

Gladiator9797 · Published 2026-06-29 · Updated 2026-06-29 · CVE-2026-7656

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions Zephyr versions prior to 4.4.0

Description An input validation weakness exists in the IPv6 Neighbor Discovery handlers within subsys/net/ip/ipv6 nbr.c. The functions handle ra input(), handle ns input(), and handle na input() use an incorrect boolean expression when combining RFC 4861 validity checks with ICMPv6 code checks. Due to wrong operator precedence, packets with an ICMPv6 code of 0 cause the entire validation predicate to evaluate as false, allowing the system to skip mandatory checks such as the Hop Limit verification and source address validation.

This allows an adjacent on-link attacker, or potentially a remote attacker, to send forged Router Advertisement (RA), Neighbor Solicitation (NS), and Neighbor Advertisement (NA) messages. Forged RA messages can be used to reconfigure the default router, on-link prefixes (SLAAC), MTU, timers, and DNS servers. Forged NS and NA messages can lead to neighbor-cache poisoning, enabling man-in-the-middle attacks, traffic redirection, and denial of service.

Recommendations Update to version 4.4.0 or later.

Fix

Authentication Bypass by Spoofing

Weakness Enumeration

CWE-290

CWE-670

Related Identifiers

CVE-2026-7656

Affected Products

Zephyr

References · 6

• https://github.com/zephyrproject-rtos/zephyr/commit/095f064c94b95f9c35e05602e693dc268f0cb865 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-7656 · Security Note
• https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-cpjw-rvwx-ph9f · Note
• https://twitter.com/CVEnew/status/2071735282882261156 · Twitter Post
• https://twitter.com/infoflowcloud/status/2071737015859597789 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2071740837877232028 · Twitter Post