CVE-2026-25139: 
NixOS vulnerability analysis and mitigation

CVE-2026-25139 is a multiple out-of-bounds read vulnerability in the RIOT operating system's 6LoWPAN stack, affecting version 2025.10 and all prior releases. It allows any unauthenticated attacker capable of sending or manipulating network packets to read adjacent memory locations or crash a vulnerable IoT/embedded device. The vulnerability was published on February 4, 2026, and assigned by GitHub Security (GHSA-c8fh-23qr-97mc). It carries a CVSS v3.1 base score of 9.1 (Critical) and a CVSS v4.0 base score of 8.7 (High) (GitHub Advisory, Red Hat CVE).

The root cause is an out-of-bounds read (CWE-125) in RIOT's 6LoWPAN Selective Fragment Recovery (SFR) processing code. In gnrc_sixlowpan.c at line 170, the _receive function identifies an incoming L2 frame as SFR based on its dispatch byte and routes it to gnrc_sixlowpan_frag_sfr_recv. Within gnrc_sixlowpan_frag_sfr.c at line 1147, the function _handle_1st_rfrag casts pkt->data directly to a sixlowpan_sfr_rfrag_t * pointer without first verifying that the packet payload is at least as large as the sixlowpan_sfr_rfrag_t structure. The resulting pointer is then immediately dereferenced at lines 1151 and 1152, meaning a crafted short or malformed frame triggers out-of-bounds reads of adjacent memory. The attack vector is network-based, requires no authentication, no privileges, and no user interaction (GitHub Advisory).

Successful exploitation can result in two primary consequences: information disclosure through reading sensitive data from memory adjacent to the packet buffer, and denial of service by crashing the device on architectures that enforce strict memory access. Because RIOT targets resource-constrained IoT and embedded devices — which are often deployed in remote or physically inaccessible locations — a crash may require manual intervention to restore service. The confidentiality and availability impacts are both rated High, while integrity is unaffected (GitHub Advisory, Red Hat CVE).

A proof-of-concept reference is linked in the GitHub Security Advisory, though detailed PoC reproduction steps are not publicly disclosed in the advisory text. There is no evidence of active in-the-wild exploitation at this time. The EPSS score is approximately 0.069%, indicating a currently low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No specific threat actor attribution has been reported (GitHub Advisory, Red Hat CVE).

1. Reconnaissance: Identify devices running RIOT OS version 2025.10 or earlier with the 6LoWPAN SFR stack enabled, using network scanning tools or IoT device discovery methods targeting IEEE 802.15.4 or similar low-power wireless networks.
2. Craft malformed SFR fragment: Construct a malformed 6LoWPAN packet with the SFR dispatch byte set correctly but with a payload shorter than the size of the sixlowpan_sfr_rfrag_t structure, ensuring the packet passes the dispatch check but fails the (absent) length validation.
3. Transmit the packet: Send the crafted packet to the target device over the network (no authentication or prior session required). The packet is received by _receive in gnrc_sixlowpan.c and dispatched to gnrc_sixlowpan_frag_sfr_recv.
4. Trigger out-of-bounds read: The _handle_1st_rfrag function casts the short payload to sixlowpan_sfr_rfrag_t * and dereferences fields at offsets beyond the actual packet data, reading adjacent memory.
5. Achieve objective: Depending on the target architecture and memory layout, the attacker either reads sensitive data from adjacent memory (information disclosure) or causes a crash/denial of service on strict memory architectures (GitHub Advisory).

• Network: Unusual or malformed 6LoWPAN SFR fragment packets (with SFR dispatch byte set but abnormally short payload) arriving at devices running RIOT OS; repeated short-frame transmissions from an unexpected source address targeting the 6LoWPAN interface.
• Logs: RIOT system logs showing unexpected crashes or hard faults in the gnrc_sixlowpan_frag_sfr module; error messages related to packet processing in the 6LoWPAN stack.
• Process/Device Behavior: Unexpected device reboots or unresponsive devices in a 6LoWPAN network; devices that stop responding to legitimate network traffic after receiving anomalous packets (GitHub Advisory).

At the time of the advisory's initial publication, no official patch existed for RIOT version 2025.10 or prior; however, patch details were subsequently added to the GitHub advisory on February 20, 2026. Users should monitor the RIOT-OS GitHub repository and upgrade to a patched release as soon as one becomes available. As an interim workaround, implement network-level access controls to restrict 6LoWPAN traffic to trusted sources only, and monitor affected devices for unexpected crashes or anomalous behavior. Disabling the 6LoWPAN SFR feature if not required is also a viable mitigation (GitHub Advisory, Red Hat CVE).

The vulnerability was reported by security researcher "pamusuo" and published via the RIOT-OS GitHub Security Advisory program. Red Hat has tracked the CVE in their security database. No significant broader media coverage or notable public researcher commentary beyond the advisory itself has been identified at this time (GitHub Advisory, Red Hat CVE).