CVE-2026-10639

Name of the Vulnerable Software and Affected Versions Zephyr versions 1.14 through 4.4.0

Description A use-after-free issue exists in the native IPv4 stack within the icmpv4 handle echo request() function in subsys/net/ip/icmpv4.c. The function creates an echo-reply packet and passes it to net try send data(), which transfers ownership of the packet to the transmission path. This process can release the packet memory back to its slab via net pkt unref() and k mem slab free() before the function calls net stats update icmp sent() using net pkt iface(reply). Consequently, the system reads the iface variable from freed or reallocated memory. When CONFIG NET STATISTICS PER INTERFACE is enabled, this can lead to a write operation through a stale pointer. This flaw is reachable unauthenticated by any remote host sending a ping request and is gated by CONFIG NET STATISTICS ICMP. The impact includes potential corruption of interface statistics or a remotely triggerable denial-of-service (DoS) crash due to a timing race.

Recommendations Update Zephyr to a version later than 4.4.0. As a temporary mitigation, disable CONFIG NET STATISTICS ICMP to prevent the vulnerable code path from being executed.