Description

The IPv6 neighbor-discovery code in subsys/net/ip/ipv6_nbr.c processes the 6LoWPAN Context Option (6CO, RFC 6775) carried inside ICMPv6 Router Advertisements. In handle_ra_6co() the 8-bit context_len field is taken directly from the packet and was never bounded to the RFC maximum of 128. The function computes context->context_len / 8 and then performs memset(context->prefix + context_len, 0, sizeof(context->prefix) - context_len), where context->prefix is a fixed 16-byte array. With context_len between 136 and 255 (and the option length field set to 3, which the pre-fix validation accepts), context_len / 8 evaluates to 17..31, so the memset length 16 - context_len/8 underflows the unsigned size_t argument to roughly SIZE_MAX. This produces an unbounded out-of-bounds memset that zeroes kernel memory well past the 6lo context structure. The defect is reachable from unauthenticated, link-local input: any host on the same link can send a crafted Router Advertisement with a 6CO option. The RA handler validates only the option length field before calling handle_ra_6co(), so a single packet triggers the wild write. The code is compiled when CONFIG_NET_6LO_CONTEXT is enabled. The impact is a reliable remote (adjacent) denial of service via memory corruption, with collateral integrity loss as the memset zeroes contiguous memory before the system faults. Router Advertisements are link-scoped and not forwarded, so the attacker must be on the same link (AV:A). The fix rejects any context_len greater than 128 before the length computation.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.1",
  "pubDate": "2026-08-19T21:16:53.633Z",
  "pubdate": "2026-08-19T21:16:53.633Z",
  "executiveSummary": "An integer underflow vulnerability exists in the IPv6 neighbor-discovery code within subsys/net/ip/ipv6_nbr.c of the affected network stack. The vulnerability is triggered when processing the 6LoWPAN Context Option (6CO, RFC 6775) within ICMPv6 Router Advertisements. Specifically, the 8-bit context_len field is extracted directly from the incoming packet without proper bounds validation against the RFC maximum of 128. This unvalidated length value is utilized in a calculation that leads to an unsigned size_t underflow during a memory zeroing operation.\nThe primary impact of this vulnerability is a reliable remote denial of service via memory corruption, alongside potential collateral integrity loss as critical kernel memory is zeroed out prior to a system fault. The affected systems are those configured with CONFIG_NET_6LO_CONTEXT enabled.\nExploitation requires an unauthenticated attacker to be positioned on the same link (adjacent network exposure, AV:A), as Router Advertisements are link-scoped and not forwarded. A single crafted ICMPv6 Router Advertisement containing a malicious 6CO option is sufficient to trigger the wild write and crash the target system.",
  "technicalDetails": "The vulnerability resides in the handle_ra_6co() function located in the vulnerable component subsys/net/ip/ipv6_nbr.c. The routine is responsible for handling 6LoWPAN Context Options (6CO) defined in RFC 6775 and carried inside ICMPv6 Router Advertisements.\nThe root cause of the flaw is the absence of bounds checking on the 8-bit context_len field retrieved directly from the network packet. The RFC specifies a maximum context length of 128, but the input code previously accepted values up to 255 provided the option length field was set to 3. Within handle_ra_6co(), the code evaluates context->context_len / 8 and subsequently passes the resulting value to a zeroing operation: memset(context->prefix + context_len, 0, sizeof(context->prefix) - context_len), where context->prefix is a fixed 16-byte array.\nWhen an attacker crafts a packet where context_len is set between 136 and 255, the division context_len / 8 evaluates to a range between 17 and 31. Consequently, the expression sizeof(context->prefix) - context_len (or the derived byte length calculation) underflows the unsigned size_t argument to approximately SIZE_MAX. This transforms the expected bounded buffer zeroing into an unbounded out-of-bounds memset operation that overwrites kernel memory contiguous to the 6lo context structure with zeroes.\nThe attack flow proceeds as follows: 1) An unauthenticated attacker on the local link transmits a crafted ICMPv6 Router Advertisement containing a 6CO option with a malformed context_len field (between 136 and 255). 2) The RA packet handler processes the option length field, which passes pre-fix validation, and invokes handle_ra_6co(). 3) The function performs the mathematical operation using the unvalidated context_len. 4) The size calculation underflows, causing memset() to execute an out-of-bounds write across kernel memory. 5) The system encounters a fatal memory fault or experiences severe integrity loss resulting in a denial of service.\nAuthentication and privilege requirements are minimal; the attacker requires no prior authentication and operates via unauthenticated, link-local input. Network exposure is restricted to the adjacent link (AV:A) due to the link-scoped nature of ICMPv6 Router Advertisements."
}