zephyrproject zephyr

• CVE-2026-10638 Medium 5.9 Use-after-free in Zephyr ICMPv6 RX path when updating statistics after sending an echo reply or error 0.4%
• CVE-2026-10637 Medium 5.9 Use-after-free of `net_pkt` in IPv6 MLD send path triggerable by a link-local MLD Query 0.3%
• CVE-2026-10636 Low 3.7 Use-after-free in Zephyr IPv4 IGMP send path (`igmp_send`) 0.3%
• CVE-2026-10635 Medium 6.3 Dangling memory-domain pointer (use-after-free) in Xtensa MMU page-table code on memory-domain de-init 0.2%
• CVE-2026-10634 Medium 4.8 Use-after-free in Zephyr native TCP `net_tcp_foreach()` due to dropping `tcp_lock` during the callback 0.3%