PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-7656 zephyrproject CVE debrief

The IPv6 Neighbor Discovery handlers in Zephyr's subsys/net/ip/ipv6_nbr.c contained an incorrect boolean expression that combined RFC 4861 validity checks with the ICMPv6 code check using wrong operator precedence. This allowed an attacker to bypass checks, including the mandatory Hop Limit == 255 verification and source address checks for Router Advertisements. As a result, an adjacent on-link attacker — and potentially a remote/off-link attacker whose packets would otherwise be rejected — can have forged Router Advertisement, Neighbor Solicitation, and Neighbor Advertisement messages accepted. A forged RA lets the attacker reconfigure the victim's default router, on-link prefixes (SLAAC), MTU, reachable/retransmit timers, and DNS servers, while forged NS/NA enable neighbor-cache poisoning, enabling man-in-the-middle, traffic redirection, and denial of service.

Vendor
zephyrproject
Product
zephyr
CVSS
HIGH 8.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-29
Original CVE updated
2026-07-17
Advisory published
2026-06-29
Advisory updated
2026-07-17

Who should care

Users of Zephyr versions up to 4.4.0, network administrators, and security teams should be aware of this vulnerability and take steps to mitigate it. Affected operators should review their deployments and assess the potential impact. Platform administrators should ensure that their systems are updated or patched accordingly. Vulnerability management teams should prioritize this issue and coordinate with security teams to implement compensating controls if necessary.

Technical summary

The IPv6 Neighbor Discovery handlers in subsys/net/ip/ipv6_nbr.c (handle_ra_input, handle_ns_input, handle_na_input) used an incorrect boolean expression that combined the RFC 4861 validity checks with the ICMPv6 code check using the wrong operator precedence: the form was '((length/hop/source/target checks) && (icmp_hdr->code != 0))'. Because every legitimate ND message carries ICMPv6 code 0, an attacker setting code == 0 (the normal value) caused the entire predicate to evaluate false, so the packet was never dropped and all of the other checks were silently skipped.

Defensive priority

High

Recommended defensive actions

  • Apply the patch from https://github.com/zephyrproject-rtos/zephyr/commit/095f064c94b95f9c35e05602e693dc268f0cb865
  • Review and update Zephyr to version 4.4.1 or later
  • Implement compensating controls, such as monitoring and filtering of IPv6 Neighbor Discovery traffic
  • Verify the integrity of Router Advertisement and Neighbor Solicitation/Advertisement messages
  • Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
  • Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
  • Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed

Evidence notes

The CVE record was published on 2026-06-29T23:16:43.650Z and was last modified on 2026-07-17T16:17:18.483Z. The NVD entry is currently Modified. This information is based on the supplied source corpus and may not reflect the current state of the vulnerability. Defenders should verify the information with the CVE record and NVD entry for the most up-to-date details.

Official resources

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-06-29T23:16:43.650Z and has not been modified since then.