CVE-2026-1678: 
NixOS vulnerability analysis and mitigation

CVE-2026-1678 is a critical out-of-bounds write vulnerability in the dns_unpack_name() function of the Zephyr RTOS DNS resolver (subsys/net/lib/dns/dns_pack.c). The function caches the buffer tailroom once and reuses the stale value while appending DNS labels, allowing the final null terminator to be written past the buffer boundary when assertions are disabled (the default configuration). It affects Zephyr versions up to and including 4.3.0 with CONFIG_DNS_RESOLVER enabled. Disclosed on March 5, 2026, it carries a CVSS v3.1 base score of 9.4 (Critical) per the GitHub Security Advisory, and 9.8 (Critical) per NVD (GitHub Advisory, Red Hat CVE).

The root cause (CWE-787: Out-of-bounds Write) lies in dns_unpack_name() in subsys/net/lib/dns/dns_pack.c (lines 486–554), which snapshots dest_size = net_buf_tailroom(buf) once at the start and never refreshes it. As buf->len grows with each appended label and separator, the stale bound no longer reflects remaining space; the final null terminator (buf->data[buf->len] = '\0') is written without a fresh tailroom check. The net_buf add helpers (net_buf_add_u8, net_buf_add_mem) rely solely on assertions for bounds enforcement, which are disabled by default (CONFIG_ASSERT=n). An attacker can craft a DNS response with repeated 63-byte labels (e.g., 5 labels) so the decoded name exceeds the 255-byte CONFIG_DNS_RESOLVER_MAX_QUERY_LEN buffer while remaining within the 512-byte DNS_RESOLVER_MAX_ANSWER_SIZE, overflowing approximately 100–200 bytes of attacker-controlled data (GitHub Advisory).

Successful exploitation allows a remote, unauthenticated attacker to write attacker-controlled data out-of-bounds in memory, resulting in high integrity and availability impact and plausible remote code execution (RCE) depending on memory layout. Denial of service is also achievable. All Zephyr-based IoT and embedded devices running versions ≤ 4.3.0 with CONFIG_DNS_RESOLVER enabled are affected, potentially exposing millions of IoT devices to memory corruption via malicious DNS responses (GitHub Advisory, Security Online).

A proof-of-concept (PoC) exploit concept is publicly documented in the GitHub Security Advisory, demonstrating how crafted DNS responses with repeated 63-byte labels trigger the overflow. There is no evidence of active in-the-wild exploitation at this time. The attack requires no authentication, no user interaction, and is network-reachable, making it highly accessible to remote attackers. The EPSS score is approximately 0.038% (low probability of near-term exploitation), and the vulnerability is not currently listed in the CISA KEV catalog (GitHub Advisory, Feedly).

1. Reconnaissance: Identify target devices running Zephyr RTOS ≤ 4.3.0 with CONFIG_DNS_RESOLVER enabled and CONFIG_ASSERT=n (the default). These are typically embedded/IoT devices performing DNS lookups.
2. Position for DNS response interception: Set up a rogue DNS server or perform a man-in-the-middle attack to intercept DNS queries from the target device, or operate a malicious authoritative DNS server that the target queries.
3. Craft malicious DNS response: Construct a DNS response containing a domain name composed of repeated 63-byte labels (e.g., 5 labels of 63 bytes each), so the total decoded name length exceeds the 255-byte destination buffer (CONFIG_DNS_RESOLVER_MAX_QUERY_LEN) but remains within the 512-byte message size limit (DNS_RESOLVER_MAX_ANSWER_SIZE).
4. Trigger the overflow: Deliver the crafted DNS response to the target. As dns_unpack_name() processes each label, buf->len grows while dest_size remains stale, causing net_buf_add_mem and the final null terminator write to overflow the buffer by approximately 100–200 bytes of attacker-controlled data.
5. Achieve code execution or DoS: Depending on the memory layout of the target device, the out-of-bounds write may corrupt adjacent memory structures to enable RCE, or cause a crash resulting in denial of service (GitHub Advisory).

• Network: Unusual DNS responses containing domain names with multiple maximum-length (63-byte) labels; DNS response payloads approaching or exceeding 255 bytes in the name field; unexpected DNS traffic from unknown or untrusted servers to Zephyr-based devices.
• Process/Runtime: Unexpected device crashes or reboots following DNS resolution activity; assertion failures in debug builds (net_buf overflow assertions) logged to serial/debug output.
• Logs: DNS resolver error logs indicating -EMSGSIZE returns or memory corruption-related faults; kernel panic or fault handler output referencing dns_pack.c or dns_unpack_name.
• File System / Memory: Evidence of heap or stack corruption in post-mortem crash dumps from Zephyr devices; unexpected control flow or code execution artifacts in device firmware memory (GitHub Advisory).

Patches have been merged for the following Zephyr branches: main (PR #99683), v4.3 (PR #99830), v4.2 (PR #99829), and v3.7 (PR #99828). Users should update to a patched version as soon as releases incorporating these fixes are available. As an immediate workaround, disable CONFIG_DNS_RESOLVER in the Kconfig if DNS resolution is not required by the application. Additionally, implement network-level controls to restrict DNS traffic from untrusted sources to vulnerable devices (GitHub Advisory).

The vulnerability was reported by security researcher 0xkato and published by Zephyr maintainer ceolin on March 5, 2026. Security Online noted the flaw "exposes millions of IoT devices to RCE," highlighting the broad attack surface of Zephyr-based embedded systems (Security Online). The Hacker Wire and InfinitSec also covered the vulnerability shortly after disclosure, and it was included in a weekly threat landscape digest (The Hacker Wire, InfinitSec). Red Hat tracked the advisory, indicating awareness across the broader embedded Linux and RTOS ecosystem (Red Hat CVE).