CVE-2026-1681

Issuing an ICMP ping via the `net ping` shell command to a device's own IPv4 address causes the network stack to recursively re-enter the input path on the same system work-queue stack. Because the destination is recognized as a local address, both the echo request and the resulting echo reply are processed inline before the current frame returns. The nested input-path frames exceed the work-queue stack and trigger a stack overflow.

CVSS v3 6.1 MEDIUM

6.1^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.8 / Impact : 4.2

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-6fcc-8rwr-w7xx	Exploit Patch Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:o:zephyrproject:zephyr:*:*:*:*:*:*:*:*

History

26 Oct 2026, 18:10

Type	Values Removed	Values Added
Summary		(es) Emitir un ping ICMP a través del comando de shell ’net ping’ a la propia dirección IPv4 de un dispositivo provoca que la pila de red reingrese recursivamente la ruta de entrada en la misma pila de cola de trabajo del sistema. Debido a que el destino se reconoce como una dirección local, tanto la solicitud de eco como la respuesta de eco resultante se procesan en línea antes de que el marco actual regrese. Los marcos de ruta de entrada anidados exceden la pila de cola de trabajo y desencadenan un desbordamiento de pila.

Information

Published : 2026-05-12 07:16

Updated : 2026-10-26 18:10

NVD link : CVE-2026-1681

Mitre link : CVE-2026-1681

CVE.ORG link : CVE-2026-1681

JSON object : View

Products Affected

zephyrproject

zephyr

CWE

CWE-674

Uncontrolled Recursion

CWE-787

Out-of-bounds Write

{"id": "CVE-2026-1681", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-1681", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-12T13:15:37.113227Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "vulnerabilities@zephyrproject.org", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 4.2, "exploitabilityScore": 1.8}]}, "affected": [{"source": "vulnerabilities@zephyrproject.org", "affectedData": [{"repo": "https://github.com/zephyrproject-rtos/zephyr", "vendor": "zephyrproject-rtos", "product": "Zephyr", "versions": [{"status": "affected", "version": "*", "lessThan": "4.4.0", "versionType": "git"}], "packageName": "Zephyr", "defaultStatus": "unaffected"}]}], "published": "2026-05-12T07:16:09.843", "references": [{"url": "https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-6fcc-8rwr-w7xx", "tags": ["Exploit", "Patch", "Vendor Advisory"], "source": "vulnerabilities@zephyrproject.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "vulnerabilities@zephyrproject.org", "description": [{"lang": "en", "value": "CWE-674"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-787"}]}], "descriptions": [{"lang": "en", "value": "Issuing an ICMP ping via the `net ping` shell command to a device's own IPv4 address causes the network stack to recursively re-enter the input path on the same system work-queue stack. Because the destination is recognized as a local address, both the echo request and the resulting echo reply are processed inline before the current frame returns. The nested input-path frames exceed the work-queue stack and trigger a stack overflow."}, {"lang": "es", "value": "Emitir un ping ICMP a trav\u00e9s del comando de shell \u2019net ping\u2019 a la propia direcci\u00f3n IPv4 de un dispositivo provoca que la pila de red reingrese recursivamente la ruta de entrada en la misma pila de cola de trabajo del sistema. Debido a que el destino se reconoce como una direcci\u00f3n local, tanto la solicitud de eco como la respuesta de eco resultante se procesan en l\u00ednea antes de que el marco actual regrese. Los marcos de ruta de entrada anidados exceden la pila de cola de trabajo y desencadenan un desbordamiento de pila."}], "lastModified": "2026-10-26T18:10:00.173", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:zephyrproject:zephyr:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7D912614-A39E-4C9B-AA54-187BC26337B9", "versionEndIncluding": "4.3.0"}], "operator": "OR"}]}], "sourceIdentifier": "vulnerabilities@zephyrproject.org"}