Denial of Service Vulnerability in Zephyr's IPv6 Network Stack

CVE-2026-13351

What is CVE-2026-13351?

A vulnerability exists in Zephyr's IPv6 network stack that enables an attacker to disrupt network services. By sending a limited number of specially crafted fragmented IPv6 packets, unauthorized parties can prevent the system from processing further incoming packets. This occurs due to the improper management of RX network packet buffers that are allocated from a memory slab. Once exhausted, the device is unable to receive additional traffic, leading to a significant disruption in network operations and resulting in a denial of service for legitimate users.

References