CVE-2026-10637

Name of the Vulnerable Software and Affected Versions Zephyr (affected versions not specified)

Description A use-after-free issue exists in the mld send() function within the IPv6 Multicast Listener Discovery (MLD) implementation. The function attempts to read the packet interface using net pkt iface(pkt) after net send data(pkt) has successfully returned. According to the network stack ownership contract, a successful send operation transfers ownership of the net pkt, leading the L2 driver to free it. Consequently, accessing the packet after this call results in a read of a freed object. When CONFIG NET STATISTICS PER INTERFACE is enabled, the recovered interface pointer is dereferenced to update statistics. If the memory is concurrently reallocated, this can lead to a NULL-pointer dereference causing a crash or a stray write resulting in memory corruption. This can be triggered remotely without authentication on the local link by sending a valid MLDv2 General Query, which prompts the handle mld query() function to call send mld report() and subsequently mld send(), potentially leading to a denial of service.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.