Denial of Service Vulnerability in Zephyr's Ethernet Bridge Feature

CVE-2026-14696

What is CVE-2026-14696?

A Denial of Service vulnerability exists in Zephyr RTOS when the Ethernet bridging feature is enabled. Specifically, the issue arises in the eth_bridge_input_process() function, where the processing of received frames can lead to memory leaks. If a broadcast flood occurs within a bridged Layer 2 segment, devices can emit frames without authentication, causing the RX buffer pool to be exhausted. This situation effectively denies network traffic until the device is rebooted, as the system fails to reclaim the leaked memory correctly. A fix has been introduced to ensure the proper management of packet references to prevent such leaks.

References