CVE-2026-1681: net: Stack Overflow with Ping (to own IP Address) via Shell
Issuing an ICMP ping via the net ping shell command to a device's own IPv4 address causes the network stack to recursively re-enter the input path on the same system work-queue stack. Because the destination is recognized as a local address, both the echo request and the resulting echo reply are processed inline before the current frame returns. The nested input-path frames exceed the work-queue stack and trigger a stack overflow.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-1681?
CVE-2026-1681 is considered a critical vulnerability due to the potential for stack overflow and remote code execution.
How do I fix CVE-2026-1681?
To fix CVE-2026-1681, update to the latest version of the Zephyr Project Zephyr that addresses this vulnerability.
What systems are affected by CVE-2026-1681?
CVE-2026-1681 primarily affects devices running the Zephyr Project Zephyr operating system.
Can CVE-2026-1681 be exploited remotely?
Yes, CVE-2026-1681 can be exploited remotely via the `net ping` shell command targeting the device's own IP address.
What are the consequences of exploiting CVE-2026-1681?
Exploiting CVE-2026-1681 can lead to denial of service or potentially allow an attacker to execute arbitrary code on the affected device.