CVE-2026-7656

Received Received - Intake

IPv6 Neighbor Discovery Bypass in Zephyr RTOS

Publication date: 2026-06-29

Last updated on: 2026-06-29

Assigner: Zephyr Project

Description

The IPv6 Neighbor Discovery handlers in subsys/net/ip/ipv6_nbr.c (handle_ra_input, handle_ns_input, handle_na_input) used an incorrect boolean expression that combined the RFC 4861 validity checks with the ICMPv6 code check using the wrong operator precedence: the form was '((length/hop/source/target checks) && (icmp_hdr-code != 0))'. Because every legitimate ND message carries ICMPv6 code 0, an attacker setting code == 0 (the normal value) caused the entire predicate to evaluate false, so the packet was never dropped and all of the other checks were silently skipped. The bypassed checks include the mandatory Hop Limit == 255 verification (which proves an ND packet originated on-link and was not forwarded) and, for Router Advertisements, the requirement that the source be a link-local address, as well as multicast-target sanity checks. As a result, an adjacent on-link attacker — and, because the Hop-Limit-255 guard is bypassed, potentially a remote/off-link attacker whose packets would otherwise be rejected — can have forged Router Advertisement, Neighbor Solicitation, and Neighbor Advertisement messages accepted. A forged RA lets the attacker reconfigure the victim's default router, on-link prefixes (SLAAC), MTU, reachable/retransmit timers, and (with CONFIG_NET_IPV6_RA_RDNSS) DNS servers, while forged NS/NA enable neighbor-cache poisoning, enabling man-in-the-middle, traffic redirection, and denial of service. The flaw is an input-validation/authentication weakness rather than a memory-safety issue: the underlying packet-parsing primitives (net_pkt_get_data, net_pkt_read, net_pkt_skip) are independently bounds-safe and the validated 'length' is the true buffer length, so skipping the length check causes no out-of-bounds access. The defect has existed since the logic was introduced in 2018 and shipped in all releases through v4.4.0; it is fixed by splitting the condition so any failing check drops the packet.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-29

Last Modified

2026-06-29

Generated

2026-06-30

AI Q&A

2026-06-30

EPSS Evaluated

N/A

NVD

CVE-2026-7656

Affected Vendors & Products

Vendor	Product	Version / Range
zephyrproject	zephyr	to 4.4.0 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-290	This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.
CWE-670	The code contains a control flow path that does not reflect the algorithm that the path is intended to implement, leading to incorrect behavior any time this path is navigated.

Attack-Flow Graph

Executive Summary

This vulnerability is in the IPv6 Neighbor Discovery handlers of the Zephyr project, specifically in the code that processes Router Advertisement (RA), Neighbor Solicitation (NS), and Neighbor Advertisement (NA) messages. The problem arises from an incorrect boolean expression that combines validity checks with an ICMPv6 code check using the wrong operator precedence.

Because legitimate Neighbor Discovery messages always have an ICMPv6 code of 0, the flawed condition causes the checks to be skipped when the code is 0, allowing malformed or malicious packets to bypass important validation steps.

This means that an attacker on the same local network (on-link) or potentially even a remote attacker (off-link) can send forged RA, NS, or NA messages that are accepted by the system without proper verification.

The impact of this is that attackers can manipulate network configuration parameters such as default routers, on-link prefixes, MTU, timers, DNS servers, or poison the neighbor cache, enabling man-in-the-middle attacks, traffic redirection, or denial of service.

Impact Analysis

This vulnerability can have serious impacts on network security and reliability. An attacker can exploit it to:

Reconfigure your device's network settings such as default router, prefixes, MTU, timers, and DNS servers.
Poison the neighbor cache, which can lead to man-in-the-middle attacks where the attacker intercepts or alters your network traffic.
Redirect or disrupt your network traffic, causing denial of service or degraded network performance.
Potentially allow remote attackers to bypass normal network protections due to the bypass of the Hop Limit == 255 check.

Hi! I’m here to help you understand CVE-2026-7656. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70