CVE-2026-10686

Name of the Vulnerable Software and Affected Versions Zephyr versions 1.8.0 through 4.4.1

Description The IPv6 forwarding path fails to decrement the IPv6 hop limit when re-sending routed unicast packets. This issue affects both the explicit-route path net route packet() and the on-link cross-interface path net route packet if() within the ipv6 route packet() function. Because the hop limit remains untouched and no expiry check is performed before calling net send data(), a device acting as an IPv6 router may relay looping packets indefinitely. An attacker capable of inducing a transient L3 loop can trigger a permanent forwarding storm, leading to CPU and bandwidth resource exhaustion, resulting in a denial of service (DoS). Additionally, path-discovery and loop diagnostics that depend on hop-limit expiry are rendered ineffective. The issue is present in configurations where CONFIG NET ROUTE and CONFIG NET ROUTING are enabled.

Recommendations Update Zephyr to a version later than 4.4.1. As a temporary mitigation, disable the CONFIG NET ROUTE and CONFIG NET ROUTING configurations to prevent the use of the vulnerable forwarding path.