CVE-2026-10686 zephyrproject CVE debrief

Who should care

Users of Zephyr with IPv6 forwarding enabled, network administrators, security teams, and operators of affected systems should review and apply patches, verify configurations, and monitor for unusual network activity. This vulnerability can cause CPU/bandwidth resource exhaustion on the forwarder and adjacent links, leading to availability DoS.

Technical summary

The IPv6 forwarding path in Zephyr did not decrement the hop limit, allowing packets to loop indefinitely. This can be exploited by an on-path attacker to cause a permanent forwarding storm, leading to CPU/bandwidth resource exhaustion on the forwarder and adjacent links. The issue was introduced in v1.8.0 and affected releases up to v4.4.1. Fixed on main by 7d8f1afa7345 and 589eadc74efa. Affected configurations include those with CONFIG_NET_ROUTE and CONFIG_NET_ROUTING enabled. IPv4 is not affected.

Defensive priority

Medium priority due to potential for availability DoS

Recommended defensive actions

• Review and apply patches for affected Zephyr versions
• Verify configuration for IPv6 forwarding
• Monitor for unusual network activity
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The IPv6 forwarding path in Zephyr did not decrement the hop limit, allowing packets to loop indefinitely. Fixed on main by 7d8f1afa7345 and 589eadc74efa. The issue was introduced in v1.8.0 and affected releases up to v4.4.1. Users should verify their configurations and apply patches. Evidence is limited, and defenders should review the CVE record and NVD details for further information.

Official resources