CVE-2026-15893: Zephyr IPv6 Neighbor Discovery zero reachable time from crafted Router Advertisement causes assertion/DoS
netifipv6calcreachabletime() in subsys/net/ip/netif.c derives a randomized ND reachable time from ipv6->basereachabletime as minreachable + sysrand32get() % (maxreachable - minreachable), where minreachable = base/2 and maxreachable = 3base/2 using integer division. When basereachabletime is 1, both minreachable and the modulus collapse so the function returns 0, and netifipv6setreachabletime() stores that 0 into ipv6->reachabletime.
The basereachabletime is attacker-controlled: handlerainput() in subsys/net/ip/ipv6nbr.c accepts the Reachable Time field of an incoming Router Advertisement whenever it is nonzero and <= MAXREACHABLETIME, so a single unauthenticated, link-local RA carrying a Reachable Time of 1 drives the computed reachable time to 0. Router Advertisements are unauthenticated by default and require only adjacency to the target link.
When a neighbor is subsequently confirmed reachable, netipv6nbrsetreachabletimer() reads the value and executes NETASSERT(time, "Zero reachable timeout!"). On builds with CONFIGASSERT enabled this triggers a fatal kernel assertion — a remote denial of service; on builds without assertions the reachable timer is armed with KMSEC(0) and fires immediately, forcing reachable neighbors into perpetual re-solicitation (STALE), degrading Neighbor Discovery. The impact is limited to availability; there is no memory-safety, confidentiality, or integrity consequence.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Harden handle_ra_input()/net_if_ipv6_calc_reachable_time() so that attacker-controlled Reachable Time from unauthenticated, adjacent link-local Router Advertisements cannot reduce computed reachable timers to 0 (prevent the zero reachable timeout path that triggers NET_ASSERT(time, "Zero reachable timeout!") and causes immediate arming with K_MSEC(0)).
Zephyr IPv6 Neighbor Discovery (subsys/net/ip/ipv6_nbr.c / subsys/net/ip/net_if.c) base_reachable_time handling of incoming Router Advertisement Reachable Time = Do not accept crafted nonzero Reachable Time values that drive computed reachable time to 0 (e.g., reject/limit Reachable Time so it cannot result in a zero reachable timeout and does not trigger NET_ASSERT("Zero reachable timeout!")). - Compensating control
Because Router Advertisements are unauthenticated by default and only require adjacency to the target link, restrict IPv6 Router Advertisement acceptance to trusted routers/segments at the network layer (e.g., block RA traffic on untrusted ports/VLANs and only allow it from trusted upstreams).
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Zephyr systems that process IPv6 Router Advertisements on a network link are exposed when an attacker can send packets from that same link. Router Advertisements are unauthenticated by default, so the attacker does not need credentials.
What does an attacker need to send?
A single link-local Router Advertisement with a nonzero Reachable Time field set to 1 is sufficient to cause the reachable-time calculation to produce zero. The received value is accepted because it is nonzero and does not exceed MAX_REACHABLE_TIME.
What is the operational impact on assertion-enabled builds?
After the malformed Router Advertisement is processed, a subsequent neighbor reachability confirmation can invoke a fatal kernel assertion because the reachable timeout is zero. This produces a remote denial of service on builds with CONFIG_ASSERT enabled.