Description
The IPv6 stack derived the long-lived secret key used to compute RFC 7217 stable interface identifiers (gen_stable_iid() in subsys/net/ip/ipv6.c) and RFC 8981 temporary interface identifiers (gen_temporary_iid() in subsys/net/ip/ipv6_pe.c) with sys_rand_get(). That API is documented as not cryptographically secure, while both RFCs require this key to be an unpredictable random value of at least 128 bits — the unpredictability of every generated IID rests entirely on it.

Depending on the platform, sys_rand_get() resolves either to a hardware entropy device or, on boards whose entropy driver sets CONFIG_ENTROPY_NEEDS_PRNG, to the non-cryptographic xoshiro128++ generator in subsys/random/random_xoshiro128.c, which keeps a single global 128-bit state shared with every other sys_rand_get() consumer. Many of those consumers put their output directly on the wire (ephemeral source ports, DNS query IDs, CoAP message IDs and tokens, DHCPv6 transaction IDs, WebSocket masking keys), and the xoshiro state transition is invertible, so an observer of a device's traffic can recover the generator state and reconstruct the IID secret key. Additionally, with the entropy-device backend sys_rand_get() silently falls back to k_cycle_get_32() samples when the entropy driver fails, and returns no error, so the key could be derived from the cycle counter without the caller noticing.

With the key known, stable IIDs become directly computable for any prefix (the remaining HMAC inputs — prefix, interface index, interface name, DAD counter — are guessable), and temporary IIDs become linkable after a cheap search over the mixed-in k_uptime_get_32() value. This defeats the properties both features exist to provide: an attacker can track a device across networks and prefixes, and can predict its address inside a /64 without scanning, removing the usual barrier to directly targeting the host. There is no memory-safety, integrity, or availability impact.

The fix generates the key with sys_csrand_get() and aborts IID generation with -EIO when no cryptographic randomness is available, instead of silently deriving addresses from a predictable key. Both CONFIG_NET_IPV6_IID_STABLE and CONFIG_NET_IPV6_PE are experimental and disabled by default; builds using CONFIG_TEST_RANDOM_GENERATOR remain predictable by design, as sys_csrand_get() is deliberately routed back to the test generator there.
Published: 2026-10-26
Score: 3.7 Low
EPSS: n/a
KEV: No
Impact: Predictable IPv6 Interface ID Generation
Action: Apply Patch
AI Analysis

Impact

The vulnerability arises because Zephyr’s IPv6 stack derives the secret key for RFC 7217 stable identifiers and RFC 8981 temporary identifiers from sys_rand_get(), which is documented as non-cryptographic. The generated 128-bit key is entirely dependent on the PRNG state, allowing an attacker to recover the key and compute any interface address deterministically, thereby breaking the privacy guarantees of both stable and temporary IIDs.

Affected Systems

The flaw affects any Zephyr build that enables CONFIG_NET_IPV6_IID_STABLE or CONFIG_NET_IPV6_PE, especially when sys_rand_get resolves to the xoshiro128++ generator or falls back to non-cryptographic entropy sources. Although these options are experimental and disabled by default, they may be enabled by developers or remain predictable if the test random generator is used in production.

Risk and Exploitability

The CVSS score of 3.7 indicates low severity, and the vulnerability is not listed in CISA’s KEV catalog; EPSS data is unavailable. However, an attacker who can observe network traffic containing successive invocations of sys_rand_get()—for example, DHCPv6 transaction IDs or DNS query IDs—can invert the PRNG state and reconstruct the key. Once the key is known, stable IIDs become directly computable for any prefix, and temporary IIDs can be linked across time, permitting device tracking across networks and address prediction within a /64 prefix.

Generated by OpenCVE AI on October 26, 2026 at 17:24 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update Zephyr to a version that implements sys_csrand_get() for generating the IID key and fails address generation if no cryptographic randomness is available, as described in the official patch.
  • Disable the experimental CONFIG_NET_IPV6_IID_STABLE and CONFIG_NET_IPV6_PE options if they are not required for your deployment, or ensure they use a cryptographically secure random source.
  • Verify that sys_rand_get() is backed by a hardware entropy source on your target platform, or that the fallback to k_cycle_get_32() is disabled, to avoid predictable key derivation.

Generated by OpenCVE AI on October 26, 2026 at 17:24 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 26 Oct 2026 18:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 26 Oct 2026 18:15:00 +0000

Type Values Removed Values Added
First Time appeared Zephyrproject
Zephyrproject zephyr
Vendors & Products Zephyrproject
Zephyrproject zephyr

Mon, 26 Oct 2026 16:30:00 +0000

Type Values Removed Values Added
Description The IPv6 stack derived the long-lived secret key used to compute RFC 7217 stable interface identifiers (gen_stable_iid() in subsys/net/ip/ipv6.c) and RFC 8981 temporary interface identifiers (gen_temporary_iid() in subsys/net/ip/ipv6_pe.c) with sys_rand_get(). That API is documented as not cryptographically secure, while both RFCs require this key to be an unpredictable random value of at least 128 bits — the unpredictability of every generated IID rests entirely on it. Depending on the platform, sys_rand_get() resolves either to a hardware entropy device or, on boards whose entropy driver sets CONFIG_ENTROPY_NEEDS_PRNG, to the non-cryptographic xoshiro128++ generator in subsys/random/random_xoshiro128.c, which keeps a single global 128-bit state shared with every other sys_rand_get() consumer. Many of those consumers put their output directly on the wire (ephemeral source ports, DNS query IDs, CoAP message IDs and tokens, DHCPv6 transaction IDs, WebSocket masking keys), and the xoshiro state transition is invertible, so an observer of a device's traffic can recover the generator state and reconstruct the IID secret key. Additionally, with the entropy-device backend sys_rand_get() silently falls back to k_cycle_get_32() samples when the entropy driver fails, and returns no error, so the key could be derived from the cycle counter without the caller noticing. With the key known, stable IIDs become directly computable for any prefix (the remaining HMAC inputs — prefix, interface index, interface name, DAD counter — are guessable), and temporary IIDs become linkable after a cheap search over the mixed-in k_uptime_get_32() value. This defeats the properties both features exist to provide: an attacker can track a device across networks and prefixes, and can predict its address inside a /64 without scanning, removing the usual barrier to directly targeting the host. There is no memory-safety, integrity, or availability impact. The fix generates the key with sys_csrand_get() and aborts IID generation with -EIO when no cryptographic randomness is available, instead of silently deriving addresses from a predictable key. Both CONFIG_NET_IPV6_IID_STABLE and CONFIG_NET_IPV6_PE are experimental and disabled by default; builds using CONFIG_TEST_RANDOM_GENERATOR remain predictable by design, as sys_csrand_get() is deliberately routed back to the test generator there.
Title IPv6 stable and temporary interface identifiers derived from a non-cryptographic PRNG secret key
Weaknesses CWE-338
References
Metrics cvssV3_1

{'score': 3.7, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N'}

Subscriptions

Zephyrproject Zephyr
cve-icon MITRE

Status: PUBLISHED

Assigner: zephyr

Published:

Updated: 2026-10-26T17:37:10.987Z

Reserved: 2026-08-13T13:46:37.857Z

Link: CVE-2026-19742

cve-icon Vulnrichment

Updated: 2026-10-26T17:35:33.949Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-26T17:17:27.837

Modified: 2026-10-26T18:34:17.050

Link: CVE-2026-19742

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-26T18:00:08Z

Weaknesses
  • CWE-338

    Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)