CVE-2026-15893
Received Received - Intake

Randomized Reachable Time Zeroing in Zephyr RTOS IPv6 Stack

Publication date: 2026-09-14

Last updated on: 2026-09-14

Assigner: Zephyr Project

Description
net_if_ipv6_calc_reachable_time() in subsys/net/ip/net_if.c derives a randomized ND reachable time from ipv6->base_reachable_time as min_reachable + sys_rand32_get() % (max_reachable - min_reachable), where min_reachable = base/2 and max_reachable = 3*base/2 using integer division. When base_reachable_time is 1, both min_reachable and the modulus collapse so the function returns 0, and net_if_ipv6_set_reachable_time() stores that 0 into ipv6->reachable_time. The base_reachable_time is attacker-controlled: handle_ra_input() in subsys/net/ip/ipv6_nbr.c accepts the Reachable Time field of an incoming Router Advertisement whenever it is nonzero and <= MAX_REACHABLE_TIME, so a single unauthenticated, link-local RA carrying a Reachable Time of 1 drives the computed reachable time to 0. Router Advertisements are unauthenticated by default and require only adjacency to the target link. When a neighbor is subsequently confirmed reachable, net_ipv6_nbr_set_reachable_timer() reads the value and executes NET_ASSERT(time, "Zero reachable timeout!"). On builds with CONFIG_ASSERT enabled this triggers a fatal kernel assertion — a remote denial of service; on builds without assertions the reachable timer is armed with K_MSEC(0) and fires immediately, forcing reachable neighbors into perpetual re-solicitation (STALE), degrading Neighbor Discovery. The impact is limited to availability; there is no memory-safety, confidentiality, or integrity consequence.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-14
Last Modified
2026-09-14
Generated
2026-09-14
AI Q&A
2026-09-14
EPSS Evaluated
N/A
NVD
CVE-2026-15893
EUVD
EUVD-2026-77767

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
zephyrproject zephyr *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-617 The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves a denial of service in the Zephyr RTOS IPv6 stack. An attacker sends a crafted Router Advertisement with a Reachable Time of 1, causing the system to set the reachable time to 0. This triggers a kernel assertion failure (if assertions are enabled) or forces neighbors into perpetual re-solicitation (if assertions are disabled), degrading network performance.

Detection Guidance

Monitor for unexpected Router Advertisements with Reachable Time set to 1. Use packet capture tools like tcpdump or Wireshark to inspect incoming IPv6 RA messages for malformed or suspicious Reachable Time values. Check system logs for kernel assertion failures or immediate timer expirations.

Impact Analysis

The impact is limited to availability. It can cause system crashes via kernel assertion failures or degrade network performance by forcing neighbors into constant re-solicitation. There is no risk to confidentiality or integrity of data.

Mitigation Strategies

Disable IPv6 Neighbor Discovery or implement RA filtering. Enable IPv6 authentication (SEND) if supported. Update Zephyr RTOS to a patched version. Block unauthenticated RA messages at the network perimeter or host firewall.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-15893. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart