CVE-2026-7656

Modified Modified - Updated After Analysis

IPv6 Neighbor Discovery Bypass in Zephyr RTOS

Publication date: 2026-06-29

Last updated on: 2026-07-17

Assigner: Zephyr Project

Description

The IPv6 Neighbor Discovery handlers in subsys/net/ip/ipv6_nbr.c (handle_ra_input, handle_ns_input, handle_na_input) used an incorrect boolean expression that combined the RFC 4861 validity checks with the ICMPv6 code check using the wrong operator precedence: the form was '((length/hop/source/target checks) && (icmp_hdr->code != 0))'. Because every legitimate ND message carries ICMPv6 code 0, an attacker setting code == 0 (the normal value) caused the entire predicate to evaluate false, so the packet was never dropped and all of the other checks were silently skipped. The bypassed checks include the mandatory Hop Limit == 255 verification (which proves an ND packet originated on-link and was not forwarded) and, for Router Advertisements, the requirement that the source be a link-local address, as well as multicast-target sanity checks. As a result, an adjacent on-link attacker — and, because the Hop-Limit-255 guard is bypassed, potentially a remote/off-link attacker whose packets would otherwise be rejected — can have forged Router Advertisement, Neighbor Solicitation, and Neighbor Advertisement messages accepted. A forged RA lets the attacker reconfigure the victim's default router, on-link prefixes (SLAAC), MTU, reachable/retransmit timers, and (with CONFIG_NET_IPV6_RA_RDNSS) DNS servers, while forged NS/NA enable neighbor-cache poisoning, enabling man-in-the-middle, traffic redirection, and denial of service. The flaw is an input-validation/authentication weakness rather than a memory-safety issue: the underlying packet-parsing primitives (net_pkt_get_data, net_pkt_read, net_pkt_skip) are independently bounds-safe and the validated 'length' is the true buffer length, so skipping the length check causes no out-of-bounds access. The defect has existed since the logic was introduced in 2018 and shipped in all releases through v4.4.0; it is fixed by splitting the condition so any failing check drops the packet.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-29

Last Modified

2026-07-17

Generated

2026-07-20

AI Q&A

2026-06-30

EPSS Evaluated

2026-07-18

NVD

CVE-2026-7656

Affected Vendors & Products

Vendor	Product	Version / Range
zephyrproject	zephyr	to 4.4.1 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-670	The code contains a control flow path that does not reflect the algorithm that the path is intended to implement, leading to incorrect behavior any time this path is navigated.
CWE-290	This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.

Attack-Flow Graph

Executive Summary

This vulnerability is in the IPv6 Neighbor Discovery handlers of the Zephyr project, specifically in the code that processes Router Advertisement (RA), Neighbor Solicitation (NS), and Neighbor Advertisement (NA) messages. The problem arises from an incorrect boolean expression that combines validity checks with an ICMPv6 code check using the wrong operator precedence.

Because legitimate Neighbor Discovery messages always have an ICMPv6 code of 0, the flawed condition causes the checks to be skipped when the code is 0, allowing malformed or malicious packets to bypass important validation steps.

This means that an attacker on the same local network (on-link) or potentially even a remote attacker (off-link) can send forged RA, NS, or NA messages that are accepted by the system without proper verification.

The impact of this is that attackers can manipulate network configuration parameters such as default routers, on-link prefixes, MTU, timers, DNS servers, or poison the neighbor cache, enabling man-in-the-middle attacks, traffic redirection, or denial of service.

Detection Guidance

Detection of this vulnerability involves monitoring IPv6 Neighbor Discovery (ND) packets such as Router Advertisements (RA), Neighbor Solicitations (NS), and Neighbor Advertisements (NA) for anomalies or forged messages that bypass proper validation checks.

Since the vulnerability allows forged ND packets with ICMPv6 code 0 to bypass hop limit and source address checks, you can detect suspicious packets by capturing and analyzing IPv6 ND traffic on your network.

Common commands to capture and inspect such packets include:

Using tcpdump to capture IPv6 ND packets: tcpdump -i <interface> icmp6 and 'ip6[40] == 134 or ip6[40] == 135 or ip6[40] == 136'
Using tshark to filter and analyze ND packets: tshark -i <interface> -Y "icmpv6.type == 134 or icmpv6.type == 135 or icmpv6.type == 136"

After capturing, inspect the hop limit field (should be 255) and verify the source address is link-local for Router Advertisements, as per RFC 4861. Packets not meeting these criteria may indicate exploitation attempts.

Impact Analysis

This vulnerability can have serious impacts on network security and reliability. An attacker can exploit it to:

Reconfigure your device's network settings such as default router, prefixes, MTU, timers, and DNS servers.
Poison the neighbor cache, which can lead to man-in-the-middle attacks where the attacker intercepts or alters your network traffic.
Redirect or disrupt your network traffic, causing denial of service or degraded network performance.
Potentially allow remote attackers to bypass normal network protections due to the bypass of the Hop Limit == 255 check.

Compliance Impact

The vulnerability allows an attacker to forge IPv6 Neighbor Discovery messages, enabling man-in-the-middle attacks, traffic redirection, and denial of service. Such attacks can lead to unauthorized interception and manipulation of network traffic.

This could potentially impact compliance with standards and regulations like GDPR and HIPAA, which require protection of data integrity and confidentiality during transmission. By enabling traffic interception and redirection, the vulnerability may expose sensitive personal or health information to unauthorized parties, thereby violating these regulations.

Mitigation Strategies

The vulnerability is fixed by splitting the condition in the IPv6 Neighbor Discovery handlers so that any failing check drops the packet.

Immediate mitigation steps include updating the affected software to a version that includes this fix (versions after v4.4.0 of the Zephyr project).

Since the flaw allows forged Router Advertisement and Neighbor Solicitation/Advertisement messages to be accepted, network administrators should consider monitoring for suspicious ND messages and potentially restricting ND traffic to trusted sources until the patch is applied.

Hi! I’m here to help you understand CVE-2026-7656. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70