CVE-2026-102714: Integer Underflow
nxicmpv6validateoptions() scans the option area with while (length > 2) (common/src/nxicmpv6validateoptions.c:79). An area whose size leaves a one- or two-byte residue exits the loop with that tail unexamined; the residue is not negative, so the function returns NXSUCCESS. Its zero-length rejection never sees those bytes.
Every consumer then re-walks the same area, reading a two-byte option header at the residue and subtracting nxicmpv6optionlength << 3 with no zero check and no remaining-length check. Three outcomes follow, selected by bytes the attacker controls.
Zero length byte. The walker subtracts zero and advances zero. All four handlers loop forever — nxicmpv6processra (nxicmpv6processra.c:245, :528), nxicmpv6processns (:251, :329), nxicmpv6processna (:147, :156) and nxicmpv6processredirect (:247, :350). The walk runs in the IP thread, which is the highest-priority thread and does not yield inside the loop, so the system stops until a watchdog reset and the frame can be replayed after each one.
Non-zero length byte on a short residue. The three unsigned counters underflow — 2 - 8 becomes 0xFFFFFFFA — and the walk continues past the packet buffer, reading until it faults or meets a zero length byte and freezes. The Router Advertisement counter is signed and exits cleanly in this case.
One-byte residue. The walker reads a two-byte option header, over-reading one byte.
During a runaway walk, stray bytes parsing as a link-layer address option are copied into the neighbor cache (nxicmpv6processns.c:280, :293) and subsequently used as the destination MAC for frames to that neighbour, placing off-packet memory on the link. Confirmed by inspection, not reproduced.
Affected Software
Event History
Frequently Asked Questions
Which ICMPv6 processing paths are affected?
The affected option walking logic is used by router advertisement, neighbor solicitation, neighbor advertisement, and redirect processing handlers.
What packet condition triggers the unsafe option walk?
An ICMPv6 option area with a one- or two-byte trailing residue can pass validation without those bytes being examined. The later handlers then read a two-byte option header from that residue without confirming that enough bytes remain.
What happens if the trailing option length byte is zero?
All four affected handlers can loop indefinitely because the option walker neither advances nor reduces its remaining length. The loop runs in the highest-priority IP thread without yielding, stopping the system until a watchdog reset; a frame can trigger the condition again after reboot.
Are outcomes limited to a denial of service?
No. A non-zero length byte in a short trailing residue can cause unsigned length counters to underflow, because the handlers subtract the declared option size without checking the remaining length. The exact behavior depends on attacker-controlled bytes.