Zephyr’s IPv6 Neighbor Discovery send functions (net_ipv6_send_na, net_ipv6_send_ns and net_ipv6_send_rs) update per‑interface ICMP‑sent statistics by calling net_pkt_iface(pkt) after net_send_data(pkt) has already returned. Because the network stack unrefs the packet on the success path, a freshly allocated packet whose refcount is 1 may have its slab block freed before the statistics code runs—either immediately when no TX queue thread is configured or concurrently when a TX thread is running. The subsequent net_pkt_iface(pkt) reads pkt->iface from the freed slab block, and when per‑interface statistics are enabled the stale interface pointer is dereferenced to increment iface->stats.icmp.sent. If the slab block is reallocated in the meantime, the read/increment updates unrelated or attacker‑controlled memory, corrupting statistics, causing a fault or crash (denial of service), or limited memory corruption. The vulnerable Neighbor Advertisement path can be triggered by any unauthenticated on‑link node that sends ICMPv6 Neighbor Solicitations to a Zephyr device with native IPv6 enabled.

Zephyr project, versions 3.3.0 through 4.4.0, all configurations with CONFIG_NET_STATISTICS_PER_INTERFACE enabled. Systems running earlier or later versions, or those that disable per‑interface statistics, are not affected.

The attack can be triggered by any unauthenticated on‑link node that sends Neighbor Solicitations. The CVSS score of 4.2 indicates moderate severity. The EPSS score is less than 1 %, suggesting low likelihood of widespread exploitation, and the vulnerability is not listed in CISA KEV. An attacker would need only network access to the target device to trigger the flaw, and exploitation would result in corruption of statistics or a crash, rather than code execution.