CVE-2026-12633

CVE-2026-12633 is a memset-based buffer overflow in Zephyr's 6LoWPAN router advertisement handler (handle_ra_6co). The bug: when processing the Context Length option in a Router Advertisement, the code validates that the option has sufficient bytes to parse, but never validates that context_len itself falls within the RFC 6775 Section 4.2 bound of 128. When context_len exceeds 128, the length check passes but the subsequent bounds calculation underflows to SIZE_MAX, causing memset to zero unbounded kernel memory until the process faults or is killed. The critical failure is conceptual, not syntactic: the code validated packet structure (is there enough data to read?) without validating protocol semantics (does the data represent a valid protocol state?). This gap is invisible during normal development—well-formed packets from compliant neighbors will always carry context_len ≤ 128, so the code works in testing and fails only when presented with inputs the RFC explicitly forbids. In C's unsigned arithmetic, this semantic oversight becomes catastrophic rather than graceful. The underflow doesn't throw an error or abort—it wraps to a massive positive number, and memset interprets that as "zero everything from here to there." This converts a missing bounds check into a reliable adjacent-DoS: one malformed RA packet crashes the device. The adjacent-attacker model in the CVSS score is misleading for 6LoWPAN. Physical adjacency in 802.15.4 mesh networks means any node in the same PAN and broadcast domain—potentially hundreds of devices in dense sensor deployments. The "link-local is trusted" assumption is a recurring vulnerability pattern across Ethernet, Wi-Fi, Bluetooth, and now 6LoWPAN: developers treat the broadcast domain as a protective boundary, but attackers treat it as the attack surface. Check your codebase for other 8-bit bounded fields in protocol handlers where validation stops at structure without extending to RFC-mandated semantic bounds. The test suite should distinguish not just "garbage packets that fail parsing" from "structurally valid but semantically malformed inputs"—this is the specific input class that spawned this vulnerability. The fix is one comparison (`if (context_len > 128) return -EINVAL;`), but the testing gap that allowed this to persist is a systemic problem that no single patch addresses.

Reviewed through automated stages and approved by a human before publication.