CVE-2026-19742

Name of the Vulnerable Software and Affected Versions Zephyr (affected versions not specified)

Description The IPv6 stack uses a non-cryptographically secure API, sys rand get(), to derive the long-lived secret key for RFC 7217 stable interface identifiers (via gen stable iid() in subsys/net/ip/ipv6.c) and RFC 8981 temporary interface identifiers (via gen temporary iid() in subsys/net/ip/ipv6 pe.c). Because sys rand get() may rely on the invertible xoshiro128++ generator or fall back to k cycle get 32() samples upon entropy driver failure, an observer of network traffic can recover the generator state and reconstruct the secret key. This allows an attacker to compute stable interface identifiers for any prefix and link temporary identifiers, enabling device tracking across networks and predictable address targeting within a /64 prefix.

Recommendations Update the software to a version where the secret key is generated using sys csrand get() and IID generation aborts with -EIO when cryptographic randomness is unavailable. As a temporary mitigation, disable the experimental features CONFIG NET IPV6 IID STABLE and CONFIG NET IPV6 PE.