Network Denial of Service Vulnerability in Zephyr Project's IPv6 Implementation

CVE-2026-14697

What is CVE-2026-14697?

A vulnerability exists in the Zephyr RTOS where the function net_ipv6_send_ns() fails to release allocated packets under certain conditions, leading to a permanent leak of Neighbor Solicitation packets. When triggered by an adjacent attacker flooding requests with spoofed addresses, this leak can exhaust the transmit packet pool, resulting in an inability for the node to send any further network packets. This creates a persistent state of denial of service, requiring a system reboot to restore normal functionality. The issue is addressed by ensuring the unsent Neighbor Solicitation packets are appropriately released before exiting the function.

References