CVE-2026-15893— Zephyr IPv6 Neighbor Discovery zero reachable time from crafted Router Advertisement causes assertion/DoS
Quick assessment
Affected
zephyrproject zephyr
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
中的 函数基于 计算随机化的邻居发现（ND）可达时间。其计算公式为： 其中， ， ，均使用整数除法。 当 为 1 时， （即 1/2 = 0）和模数 （即 3*1/2 - 0 = 1）同时“坍缩”，导致函数返回 0。随后， 将该 0 值存入 。 受攻击者控制： 中的 会接受来自路由器通告（Router Advertisement, RA）的可达时间字段，只要该字段非零且不超过 。因此，一条未认证、仅需链路本地邻接关系的 RA，若携带可达时间为 1，即可使计算出的可达时间变为 0。默认情况下，路由器通告是未认证的，且
Possible ATT&CK Techniques 1 AI
T1527Affected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| zephyrproject | zephyr | 1.7.0< 4.4.2 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-15893
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Zephyr IPv6 Neighbor Discovery zero reachable time from crafted Router Advertisement causes assertion/DoS
Source: CVE Program / CVE List V5
Vulnerability Description
net_if_ipv6_calc_reachable_time() in subsys/net/ip/net_if.c derives a randomized ND reachable time from ipv6->base_reachable_time as min_reachable + sys_rand32_get() % (max_reachable - min_reachable), where min_reachable = base/2 and max_reachable = 3*base/2 using integer division. When base_reachable_time is 1, both min_reachable and the modulus collapse so the function returns 0, and net_if_ipv6_set_reachable_time() stores that 0 into ipv6->reachable_time.
The base_reachable_time is attacker-controlled: handle_ra_input() in subsys/net/ip/ipv6_nbr.c accepts the Reachable Time field of an incoming Router Advertisement whenever it is nonzero and <= MAX_REACHABLE_TIME, so a single unauthenticated, link-local RA carrying a Reachable Time of 1 drives the computed reachable time to 0. Router Advertisements are unauthenticated by default and require only adjacency to the target link.
When a neighbor is subsequently confirmed reachable, net_ipv6_nbr_set_reachable_timer() reads the value and executes NET_ASSERT(time, "Zero reachable timeout!"). On builds with CONFIG_ASSERT enabled this triggers a fatal kernel assertion — a remote denial of service; on builds without assertions the reachable timer is armed with K_MSEC(0) and fires immediately, forcing reachable neighbors into perpetual re-solicitation (STALE), degrading Neighbor Discovery. The impact is limited to availability; there is no memory-safety, confidentiality, or integrity consequence.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
可达断言
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| zephyrproject | zephyr | 1.7.0 ~ 4.4.2 | - |
|
II. Public POCs for CVE-2026-15893
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-15893
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-15893 (1)
Vendor Advisories for CVE-2026-15893 (1)
Same Patch Batch · zephyrproject · 2026-09-14 · 5 CVEs total
| CVE-2026-16147 | 6.8 MEDIUM | it82xx2 USB device controller submits incomplete OUT transfer buffers, causing use-after-f |
| CVE-2026-15924 | 5.9 MEDIUM | Use-after-free / double-free from unsynchronized concurrent access to the TLS client sessi |
| CVE-2026-15923 | 4.6 MEDIUM | Infinite loop denial of service in Zephyr SDIO byte-I/O from a card-supplied zero max_blk_ |
| CVE-2026-16148 | 4.6 MEDIUM | Kernel panic in the it82xx2 USB device controller driver via re-initialization of a busy d |
IV. Related Vulnerabilities
Same product: zephyr
-
CVE-2026-16148
Kernel panic in the it82xx2 USB device controller driver via -
CVE-2026-16147
it82xx2 USB device controller submits incomplete OUT transfe -
CVE-2026-15924
Use-after-free / double-free from unsynchronized concurrent -
CVE-2026-15923
Infinite loop denial of service in Zephyr SDIO byte-I/O from -
CVE-2026-15892
Heap memory leak in mcumgr settings-management handlers on a
Same vendor: zephyrproject
-
CVE-2026-16148
Kernel panic in the it82xx2 USB device controller driver via -
CVE-2026-16147
it82xx2 USB device controller submits incomplete OUT transfe -
CVE-2026-15924
Use-after-free / double-free from unsynchronized concurrent -
CVE-2026-15923
Infinite loop denial of service in Zephyr SDIO byte-I/O from -
CVE-2026-15892
Heap memory leak in mcumgr settings-management handlers on a
Same weakness: CWE-617
-
CVE-2026-90786
Dvidelabs flatcc Duplicate Symbol semantics.c align_order_me -
CVE-2026-90785
Dvidelabs flatcc Struct Analysis semantics.c analyze_struct -
CVE-2026-90685
GPAC MP4Box lsr_dec.c lsr_exec_command_list assertion -
CVE-2026-90684
GPAC MP4Box base_scenegraph.c gf_node_get_field_count assert -
CVE-2026-90683
GPAC MP4Box base_scenegraph.c gf_node_unregister assertion
V. Comments for CVE-2026-15893
No comments yet