CVE-2026-22213: 
NixOS vulnerability analysis and mitigation

CVE-2026-22213 is a stack-based buffer overflow vulnerability in the tapslip6 utility of RIOT OS, an open-source IoT operating system. The flaw exists in the devopen() function, which uses unsafe string operations (strcpy() and strcat()) to construct a device path from user-supplied input without bounds checking. Affected versions include RIOT OS up to and including 2026.01-devel-317, as well as 2026.01-rc1 and all versions prior to 2025.10. It was published on January 12, 2026, with a CVSS v3.1 base score of 9.8 (Critical) — though the CVSS v4.0 score is 2.4 (Low), reflecting a more constrained real-world attack scenario (Red Hat CVE, Full Disclosure).

The root cause is classified as CWE-121 (Stack-based Buffer Overflow). In the devopen() function within the tapslip6 utility, the code concatenates the fixed string /dev/ with a user-supplied device name provided via the -s command-line option using strcpy() and strcat() into a fixed-size stack buffer, with no length validation on the input. An attacker supplying an excessively long device name string can overflow this buffer, corrupting adjacent stack memory. A public disclosure was posted to the Full Disclosure mailing list in January 2026 (Full Disclosure, Red Hat CVE).

Successful exploitation leads to process crashes and memory corruption in the tapslip6 utility, primarily impacting availability through denial of service. Stack corruption may also create conditions for potential code execution, though the CVSS v4.0 assessment limits the vulnerability impact to low availability with no confidentiality or integrity impact in the vulnerable component. The utility is a host-side networking tool used in RIOT OS development and testing environments, so the blast radius is generally limited to development or embedded networking setups rather than production IoT device firmware (Red Hat CVE).

No public proof-of-concept exploit code has been confirmed, and there is no evidence of active in-the-wild exploitation at this time. The EPSS score is approximately 0.016%, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. A reference to the Full Disclosure mailing list was added as an exploit reference on January 21, 2026, but this appears to be the original disclosure rather than a weaponized exploit (Full Disclosure, Red Hat CVE).

1. Identify target: Locate a system running RIOT OS version 2026.01-devel-317 or earlier that has the tapslip6 utility accessible, typically in a development or testing environment.
2. Craft malicious input: Prepare an excessively long device name string (e.g., a string of 500+ characters) intended to overflow the fixed-size stack buffer in devopen().
3. Invoke the utility: Execute tapslip6 with the -s flag followed by the crafted long device name: tapslip6 -s <LONG_STRING>.
4. Trigger overflow: The devopen() function calls strcpy() to copy /dev/ into the stack buffer, then strcat() to append the user-supplied name without bounds checking, overflowing the buffer.
5. Achieve impact: The stack corruption causes the process to crash (denial of service); with a carefully crafted payload, an attacker may attempt to control the instruction pointer for arbitrary code execution (Full Disclosure).

• Process: Unexpected crashes or segmentation faults of the tapslip6 process, particularly when invoked with unusually long -s arguments.
• Logs: System logs (e.g., /var/log/syslog or dmesg) showing segfault entries referencing the tapslip6 binary; core dump files generated in the working directory.
• File System: Presence of core dump files (e.g., core, core.<pid>) associated with the tapslip6 process in the working directory.
• Command History: Shell history entries showing tapslip6 -s invocations with abnormally long argument strings.

No official patch has been confirmed as released at the time of disclosure; users should update to a RIOT OS version newer than 2026.01-devel-317 once available, or use a stable release newer than 2025.10. As an interim workaround, restrict execution of the tapslip6 utility to trusted users only and limit command-line argument sizes at the system level where possible. Consider disabling or removing access to the tapslip6 utility in environments where it is not required. Monitor the RIOT-OS GitHub repository for patch releases and security advisories (Red Hat CVE, RIOT-OS GitHub).

The vulnerability received limited public attention given its narrow scope (a development utility in an IoT OS). Red Hat tracked the CVE in their security advisory database, and INCIBE-CERT (Spain's national cybersecurity agency) published an early warning. A brief mention appeared on Bluesky via an automated CVE feed. No significant vendor statements, researcher commentary, or media coverage beyond standard vulnerability aggregator postings have been observed (Red Hat CVE).