CVE-2026-10636

Name of the Vulnerable Software and Affected Versions Zephyr versions 2.6.0 through 4.4.0

Description A use-after-free read exists in the IPv4 IGMP implementation. The function igmp send() in subsys/net/ip/igmp.c reads the network interface from a packet using net pkt iface(pkt) after the packet has been passed to net send data(). In certain configurations, the packet's last reference may be released by the L2 driver or network stack TX handling, returning the memory block to the free list before the read occurs. If CONFIG NET STATISTICS PER INTERFACE is enabled, the resulting dangling pointer is dereferenced for a statistics-counter write. This path can be triggered without authentication via inbound IPv4 IGMP membership queries addressed to 224.0.0.1 or through local multicast join, leave, or rejoin operations. This may lead to undefined behavior, sporadic crashes, or denial of service. A similar pattern exists in the IPv6 MLD path within the mld send() function in subsys/net/ip/ipv6 mld.c.

Recommendations Update Zephyr to a version where the interface pointer is cached before sending in the igmp send() function. Restrict the use of the igmp send() function or disable IPv4 IGMP membership queries to 224.0.0.1 as a temporary mitigation.