CVE-2026-19577

Executive Summary

CVE-2026-19577 is an out-of-bounds read (CWE-125) in the IPv6 routing path of the Zephyr RTOS network stack. net_route_ipv6_packet() in subsys/net/ip/route_ipv6.c resolves a nexthop's link-layer address without verifying that the neighbor cache entry is actually resolved, and the subsequent lladdr == NULL check cannot catch the resulting invalid pointer because the pointer is never NULL. An unauthenticated attacker on the same link can trigger the flaw and cause the device to read roughly 2.5 KB past the end of the neighbor link-layer address array, resulting in an availability impact (crash/denial of service) and a limited confidentiality impact (adjacent memory disclosure).

Technical Analysis

The defect lives in the IPv6 packet-forwarding/route resolution logic. When net_route_ipv6_packet() needs to forward a packet, it resolves the nexthop's link-layer address via net_nbr_get_lladdr(nbr->idx). The problem is that this call is performed before confirming the neighbor cache entry holds a valid linked link-layer address.

In Zephyr's neighbor cache, an unresolved (INCOMPLETE) entry carries idx == NET_NBR_LLADDR_UNKNOWN (0xff). The helper net_nbr_get_lladdr() in subsys/net/ip/nbr.c performs no runtime bounds check beyond a debug-time NET_ASSERT. That assertion is typically compiled out in production builds, so the function simply returns &net_neighbor_lladdr[255]. Because net_neighbor_lladdr is sized by CONFIG_NET_IPV6_MAX_NEIGHBORS (default 8) entries, index 255 points roughly 2.5 KB beyond the end of the array, into adjacent memory.

Two characteristics make the bug reachable and dangerous:

1. No NULL guard fallback. The returned pointer is never NULL, so the following lladdr == NULL check does not catch the invalid value. The code proceeds to use an out-of-bounds pointer as if it were a valid L2 address.
2. Default reachability. The path is reached from ipv6_route_packet() in subsys/net/ip/ipv6.c for every received unicast IPv6 packet whose destination is not a local address on the receiving interface. CONFIG_NET_IPV6_ROUTE is enabled by default whenever the IPv6 neighbor cache is enabled, so no explicit router or forwarding configuration is required.

The unresolved state can be forced by an attacker:

• net_route_ipv6_get_info() returns the packet's destination itself as the nexthop when a neighbor cache entry for that destination exists, and the cache lookup does not skip INCOMPLETE entries. This means an INCOMPLETE entry is sufficient to reach the faulty resolution.
• An attacker can cause an INCOMPLETE entry by eliciting traffic to a spoofed, non-existent neighbor address (causing net_ipv6_send_ns() to create the entry), or by sending a Router Advertisement with no source link-layer address option, which creates a persistently unresolved router neighbor.

The broad class: a missing bounds/state-validation check in the neighbor-cache-to-link-layer resolution path, producing an out-of-bounds read. The specific fix would require validating neighbor state (and/or the returned index) before dereferencing the link-layer address; the exact upstream patch is not available in the provided data.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the NVD description and the vulnerability class.

1. Reconnaissance / target identification. The attacker must be on the same Layer-2 link as the vulnerable Zephyr device (CVSS vector AV:A confirms adjacency). The attacker identifies a target that runs Zephyr with IPv6 neighbor cache and CONFIG_NET_IPV6_ROUTE enabled — the default configuration whenever the IPv6 neighbor cache is enabled. No authentication or user interaction is required (PR:N, UI:N).

2. Forcing the unresolved neighbor state. The attacker drives the neighbor cache into an INCOMPLETE state. Per the description, this can be done by eliciting traffic toward a spoofed, non-existent neighbor address so that net_ipv6_send_ns() creates an INCOMPLETE entry, and/or by sending a Router Advertisement lacking a source link-layer address option, which yields a persistently unresolved router neighbor. Either path places an entry with idx == NET_NBR_LLADDR_UNKNOWN (0xff) into the cache.

3. Triggering the flawed resolution. The attacker sends a unicast IPv6 packet whose destination is not a local address on the receiving interface. ipv6_route_packet() passes the packet to net_route_ipv6_packet(). Because net_route_ipv6_get_info() can return the packet destination itself as the nexthop when a matching (including INCOMPLETE) cache entry exists, and the lookup does not skip INCOMPLETE entries, the code calls net_nbr_get_lladdr(nbr->idx) with the sentinel index. The unchecked helper returns &net_neighbor_lladdr[255] — about 2.5 KB past the array. The lladdr == NULL guard does not fire because the pointer is non-NULL, and the out-of-bounds address is used as a link-layer address.

4. Post-exploitation impact. The immediate effect is an out-of-bounds read of adjacent memory, which can corrupt forwarding behavior, leak adjacent memory contents in limited form, and/or cause a crash — yielding denial of service on the affected device. CVSS subscores reflect this: A:H (high availability impact) and C:L (low confidentiality impact), with no integrity impact (I:N) and unchanged scope (S:U). No public exploit code exists, and there is no evidence of in-the-wild exploitation.

Impact Assessment

• Availability (High, A:H). The out-of-bounds dereference can cause faults/crashes, denying service for the device's IPv6 forwarding/network functionality. This is the dominant risk.
• Confidentiality (Low, C:L). The invalid pointer references memory beyond the neighbor link-layer array, creating a limited information-disclosure surface.
• Integrity (None, I:N). The flaw is a read; no data modification is described.
• Scope (Unchanged, S:U). Impact is confined to the vulnerable component.
• Attack vector (Adjacent, AV:A). Exploitation requires Layer-2 adjacency; it is not remotely exploitable from arbitrary internet paths. This narrows the blast radius to devices on the same link/network segment.
• Affected systems. Embedded/IoT devices and any Zephyr-based system with the IPv6 neighbor cache and CONFIG_NET_IPV6_ROUTE enabled (default when the neighbor cache is on). Router or forwarding configuration is not required, broadening exposure among Zephyr IPv6 deployments.
• Blast radius. At scale, many devices on the same segment could be repeatedly crash-looped by an attacker with link access, potentially degrading a fleet of embedded endpoints. Business impact centers on downtime, network instability, and the operational cost of recovering affected devices, plus a limited risk of adjacent-memory disclosure on safety- or privacy-relevant devices.

Detection Guidance

Sigma Rule

title: Zephyr IPv6 Neighbor Cache OOB Read Attempt (CVE-2026-19577)
id: 8b1e6f42-3c7a-4d9e-9a2f-7c5b0d1e6a99
status: experimental
description: Detects IPv6 layer-2 activity consistent with forcing INCOMPLETE neighbor entries (spoofed nexthop traffic, Router Advertisements without a source link-layer address option) to trigger the Zephyr net_route_ipv6_packet out-of-bounds read.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-19577
author: valtersit.com
date: 2026-01-01
logsource:
  category: network_connection
  product: zeek
detection:
  selection_ndp:
    proto: 'icmpv6'
    icmpv6_type:
      - 'neighbor_solicitation'
      - 'neighbor_advertisement'
  selection_ra_no_sllao:
    proto: 'icmpv6'
    icmpv6_type: 'router_advertisement'
    icmpv6_opt_slla: false
  condition: selection_ndp or selection_ra_no_sllao
fields:
  - id.orig_h
  - id.resp_h
  - icmpv6_type
falsepositives:
  - Legitimate NDP churn on busy segments
  - Router Advertisements legitimately omitting the source link-layer address option
level: medium
tags:
  - attack.t1190
  - cve.2026-19577

YARA Rule

rule CVE_2026_19577_Zephyr_IPv6_Neighbor_LLADDR_OOB
{
    meta:
        author = "valtersit.com"
        description = "Detects Zephyr IPv6 routing/neighbor-cache source containing the unchecked net_nbr_get_lladdr index path (CVE-2026-19577)"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-19577"
        date = "2026-01-01"
    strings:
        $f_route = "net_route_ipv6_packet"
        $f_getinfo = "net_route_ipv6_get_info"
        $f_nbr = "net_nbr_get_lladdr"
        $f_sendns = "net_ipv6_send_ns"
        $c_sentinel = "NET_NBR_LLADDR_UNKNOWN"
        $f_route_packet = "ipv6_route_packet"
        $f_nbr_src = "subsys/net/ip/nbr.c"
        $f_route_src = "subsys/net/ip/route_ipv6.c"
    condition:
        2 of ($f_*) and ($c_sentinel or $f_nbr_src or $f_route_src)
}

Suricata IDS Rule

alert icmp any any -> any any (msg:"CVE-2026-19577 Zephyr IPv6 Router Advertisement without source link-layer address option (neighbor-cache OOB read trigger)"; itype:134; icode:0; byte_test:1,!&,0x02,0,relative; reference:cve,2026-19577; classtype:attempted-dos; sid:2026195770; rev:1;)

alert icmp any any -> any any (msg:"CVE-2026-19577 Zephyr IPv6 Neighbor Solicitation/Advertisement churn (INCOMPLETE neighbor induction)"; itype:135; icode:0; reference:cve,2026-19577; classtype:network-scan; sid:2026195771; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=30s
  [network where network.transport == "icmp" and icmp.type == 135]
  [network where network.transport == "icmp" and icmp.type == 136]
  [network where network.transport == "icmp" and icmp.type == 134 and not icmp.option.source_link_layer_address == true]

Splunk SPL Query

index=network sourcetype=zeek:icmp OR sourcetype=suricata
| search (icmp_type=134 OR icmp_type=135 OR icmp_type=136 OR signature_id=2026195770 OR signature_id=2026195771)
| stats count values(icmp_type) as types values(signature) as sigs by src_ip dest_ip
| where count > 5
| table _time src_ip dest_ip types sigs count

Wazuh OSSEC Rule

<group name="zephyr,cve-2026-19577,ipv6,">
  <rule id="2026195" level="8">
    <decoded_as>json</decoded_as>
    <field name="icmpv6_type">router_advertisement</field>
    <field name="icmpv6_opt_slla">false</field>
    <description>CVE-2026-19577: IPv6 Router Advertisement without source link-layer address option observed - potential Zephyr neighbor-cache OOB read trigger</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>network_anomaly,</group>
  </rule>
  <rule id="2026196" level="6">
    <decoded_as>json</decoded_as>
    <field name="icmpv6_type">neighbor_solicitation</field>
    <description>CVE-2026-19577: IPv6 Neighbor Solicitation churn possibly inducing INCOMPLETE neighbor entries</description>
    <group>network_anomaly,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix, workaround, or affected-version data is available.

1. Immediate mitigations.

   • Where IPv6 routing/forwarding is not required, disable it to remove the reachable path: do not enable CONFIG_NET_IPV6_ROUTE, and disable the IPv6 neighbor cache if the device does not need IPv6 neighbor discovery for forwarding.
   • Enforce Layer-2 access control (802.1X, port security) and segment untrusted hosts away from Zephyr devices that require IPv6 routing, since exploitation requires same-link adjacency (AV:A).
   • Deploy switch/router features that filter rogue Router Advertisements and NDP spoofing (RA Guard / IPv6 First-Hop Security) to make it harder for an attacker to force the unresolved neighbor state.
   • Enable debug/assert builds where feasible so NET_ASSERT in net_nbr_get_lladdr() triggers rather than silently returning an out-of-bounds pointer — note this converts silent corruption into an abort and is a diagnostic, not a fix.

2. Patch / upgrade steps.

   • Monitor the Zephyr project security advisories and the NVD entry for CVE-2026-19577 for a fixed commit/version; no patched release is currently identified.
   • When a fix becomes available, upgrade the RTOS network stack and rebuild the affected firmware images, then reflash all devices carrying the vulnerable revision.
   • If a custom/vendored copy of subsys/net/ip/route_ipv6.c or subsys/net/ip/nbr.c is maintained, apply the upstream fix directly once published and backport it to your tree.

3. Long-term hardening.

   • Adopt a vulnerability-management process for embedded RTOS components, tracking CVE feeds for Zephyr and enabling OTA/firmware update capability to shorten remediation windows.
   • Minimize enabled network features to the required set ("least functionality") to reduce attack surface on devices that need only a subset of IPv6 routing behavior.
   • Add defensive coding review for neighbor-cache and pointer-return APIs, ensuring neighbor state is validated before link-layer resolution and that sentinel values (NET_NBR_LLADDR_UNKNOWN) are explicitly handled.
   • Instrument devices for crash/reboot telemetry to quickly detect availability-impacting faults from this class of bug.

References

• NVD — CVE-2026-19577: https://nvd.nist.gov/vuln/detail/CVE-2026-19577
• Zephyr Project security advisories (monitor for the fix): https://github.com/zephyrproject-rtos/zephyr/security/advisories
• Zephyr Project source (subsys/net/ip/route_ipv6.c, subsys/net/ip/nbr.c, subsys/net/ip/ipv6.c): https://github.com/zephyrproject-rtos/zephyr
• MITRE CWE-125 (Out-of-bounds Read): https://cwe.mitre.org/data/definitions/125.html
• CISA Known Exploited Vulnerabilities catalog (currently NOT listed for CVE-2026-19577): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No public proof-of-concept, exploit code, or threat-actor campaign is known for CVE-2026-19577 at the time of writing. No exploit-in-the-wild evidence is available.