From d08f4773edd0182b7910fc8f046eed82ffcd67c9 Mon Sep 17 00:00:00 2001
From: Erik Ekman <erik@kryo.se>
Date: Tue, 1 Sep 2026 13:26:18 +0200
Subject: [PATCH] Verify min MTU for IPv6 packet too big

Bug #68610, Reported by Daniel Birtwhistle
---
 src/core/ipv6/nd6.c | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/src/core/ipv6/nd6.c b/src/core/ipv6/nd6.c
index cfb47a5d..5ad50e21 100644
--- a/src/core/ipv6/nd6.c
+++ b/src/core/ipv6/nd6.c
@@ -947,9 +947,14 @@ nd6_input(struct pbuf *p, struct netif *inp)
       return;
     }
 
+    pmtu = lwip_htonl(icmp6hdr->data) & 0xFFFF;
+    if (pmtu < IP6_MIN_MTU_LENGTH) {
+      /* MTU too small */
+      pbuf_free(p);
+      return;
+    }
     /* Change the Path MTU. */
-    pmtu = lwip_htonl(icmp6hdr->data);
-    destination_cache[dest_idx].pmtu = (u16_t)LWIP_MIN(pmtu, 0xFFFF);
+    destination_cache[dest_idx].pmtu = (u16_t)pmtu;
 
     break; /* ICMP6_TYPE_PTB */
   }