The vulnerability is caused by an unbounded out‑of‑bounds write in the IPv6 neighbor‑discovery code that processes the 6LoWPAN Context Option. A malicious Router Advertisement can provide a context length field larger than the RFC 6775 maximum, causing a memset to zero beyond the intended 16‑byte array in memory and corrupting kernel state. The flaw, classified as CWE‑787, can lead to reliability loss and a local denial‑of‑service triggered by a single crafted packet.

The issue exists in Zephyr RTOS when the 6LoWPAN context feature is compiled with CONFIG_NET_6LO_CONTEXT enabled. Any Zephyr kernel that accepts Router Advertisements on the link is potentially vulnerable. No explicit version numbers are listed in the advisory, so all builds containing the affected code path should be considered at risk until the patch is applied.

The CVSS score of 8.1 indicates a high‑severity vulnerability. EPSS data is not available, so the exploitation probability is unknown but the flaw is trivial to trigger on an adjacent host. It is not listed in CISA’s KEV catalog, suggesting no active exploitation has been documented. Nevertheless, because the denial of service results from a kernel memory overwrite, an attacker on the same link can reliably crash the device with a single packet. The recommended mitigation is to apply the vendor’s patch that limits the context_len field to the RFC maximum.