Read the docs
TI-2026-13318 Aliases CVE-2026-15893

Zephyr IPv6 Neighbor Discovery zero reachable time from crafted Router Advertisement causes assertion/DoS

Priority LOW 29CWE-617Published · Updated

Key facts

Attack vector
Adjacent network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-617.

Summary

net_if_ipv6_calc_reachable_time() in subsys/net/ip/net_if.c derives a randomized ND reachable time from ipv6->base_reachable_time as min_reachable + sys_rand32_get() % (max_reachable - min_reachable), where min_reachable = base/2 and max_reachable = 3*base/2 using integer division. When base_reachable_time is 1, both min_reachable and the modulus collapse so the function returns 0, and net_if_ipv6_set_reachable_time() stores that 0 into ipv6->reachable_time. The base_reachable_time is attacker-controlled: handle_ra_input() in subsys/net/ip/ipv6_nbr.c accepts the Reachable Time field of an incoming Router Advertisement whenever it is nonzero and <= MAX_REACHABLE_TIME, so a single unauthenticated, link-local RA carrying a Reachable Time of 1 drives the computed reachable time to 0. Router Advertisements are unauthenticated by default and require only adjacency to the target link. When a neighbor is subsequently confirmed reachable, net_ipv6_nbr_set_reachable_timer() reads the value and executes NET_ASSERT(time, "Zero reachable timeout!"). On builds with CONFIG_ASSERT enabled this triggers a fatal kernel assertion — a remote denial of service; on builds without assertions the reachable timer is armed with K_MSEC(0) and fires immediately, forcing reachable neighbors into perpetual re-solicitation (STALE), degrading Neighbor Discovery. The impact is limited to availability; there is no memory-safety, confidentiality, or integrity consequence.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00326 25th percentileScored 2026-11-07
Fix Fixed zephyr (zephyrproject): 4.3.2, 4.4.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
zephyrprojectzephyr1.7.0 to before 4.3.2; 4.4.0 to before 4.4.24.3.2, 4.4.2Patch availableCNA
  • zephyr Vendorzephyrproject Affected 1.7.0 to before 4.3.2; 4.4.0 to before 4.4.2 Fixed in 4.3.2, 4.4.2 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:o:zephyrproject:zephyr:*:*:*:*:*:*:*:*——zephyrproject
  • cpe:2.3:o:zephyrproject:zephyr:*:*:*:*:*:*:*:* Versions — — ·zephyrproject

Remediation

  • Fix · CNA zephyr (zephyrproject) Fixed in 4.3.2, 4.4.2

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    zephyrproject zephyr 4.3.2, 4.4.2

    3 records Highest priority Priority LOW 3 LOW

    Other records, highest priority first

    • TI-2026-13514 Kernel panic in the it82xx2 USB device controller driver via re-initialization of a busy delayable work itemPriority LOW 21
    • TI-2026-13338 Infinite loop denial of service in Zephyr SDIO byte-I/O from a card-supplied zero max_blk_sizePriority LOW 21
    Show all 3 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-15893
  2. 2026-11-04 Fix available: [email protected] · CNA

References

Patch 1

Other 1

  • TI-2026-04422 Out-of-bounds read/write in HTTP WebSocket upgrade via non-null-terminated Sec-WebSocket-Key CVSS 3.1CRITICAL 9.8
  • TI-2026-01361 dns: memory‑safety issue in the DNS name parser CVSS 3.1CRITICAL 9.8
  • TI-2026-09174 Unterminated URI buffer causes out-of-bounds read in LwM2M firmware pull (Package URI) CVSS 3.1CRITICAL 9.1
  • TI-2026-09168 Stack buffer overflow in `net_ipaddr_parse()` IPv4 address-with-port parsing in `subsys/net/ip/utils.c` CVSS 3.1CRITICAL 9.8
  • TI-2024-09625 net: lib: http_server: Buffer Under-read CVSS 3.1HIGH 8.6
  • TI-2021-02863 Usb bluetooth device ACL read cb buffer overflow CVSS 3.1CRITICAL 9.6
See all 341 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences