CVE-2026-19577

net route ipv6 packet() in subsys/net/ip/route ipv6.c resolved the nexthop's link-layer address with net nbr get lladdr(nbr->idx) without first checking whether the neighbor cache entry actually had a linked link-layer address. An unresolved neighbor carries idx == NET NBR LLADDR UNKNOWN (0xff), and net nbr get lladdr() in subsys/net/ip/nbr.c performs no runtime bounds check beyond a NET ASSERT, returning &net neighbor lladdr[255] — roughly 2.5 KB past the end of an array whose default size is CONFIG NET IPV6 MAX NEIGHBORS (8). Because the returned pointer is never NULL, the following lladdr == NULL guard does not catch it.

The function is reached from ipv6 route packet() in subsys/net/ip/ipv6.c for every received unicast IPv6 packet whose destination is not a local address on the receiving interface; CONFIG NET IPV6 ROUTE is enabled by default whenever the IPv6 neighbor cache is, so no router or forwarding configuration is needed. net route ipv6 get info() returns the packet's destination itself as the nexthop when a neighbor cache entry for it exists, and the cache lookup does not skip INCOMPLETE entries. An unauthenticated attacker on the same link can therefore force the unresolved state — for example by eliciting traffic to a spoofed, non-existent neighbor address so that net ipv6 send ns() creates an INCOMPLETE entry, or by sending a Router Advertisement with no source link-layer address option, which creates a persistently unresolved router neighbor — and then send a packet addressed to that neighbor.

The result is an out-of-bounds read at a fixed index past the neighbor link-layer address array. On builds with CONFIG ASSERT enabled the assertion fires and the device panics, giving a repeatable remote denial of service. With assertions disabled, the stale out-of-bounds struct net linkaddr drives a memcmp() over an attacker-uninfluenced length and, when its len byte passes the NET LINK ADDR MAX LENGTH check, up to 8 bytes of unrelated static RAM are copied into the outgoing frame's destination link-layer address and transmitted on the link, disclosing them to any listener. There is no out-of-bounds write and the offset is not attacker-controlled, which bounds the impact.