CVE-2026-14697
Received Received - Intake

Memory Leak in Zephyr RTOS IPv6 Neighbor Solicitation

Publication date: 2026-08-31

Last updated on: 2026-08-31

Assigner: Zephyr Project

Description
net_ipv6_send_ns() in subsys/net/ip/ipv6_nbr.c allocates a transmit net_pkt for a Neighbor Solicitation. When it is called with a data packet pending on an unresolved neighbor and that neighbor's pending_queue is already non-empty (an NS is already outstanding), the function appends the data packet and returns early without ever sending the NS via net_send_data() or releasing it with net_pkt_unref(). The freshly allocated NS net_pkt and its attached TX buffers are held only by a local variable and are leaked permanently, never returning to CONFIG_NET_PKT_TX_COUNT / CONFIG_NET_BUF_TX_COUNT. The leaking branch sits on the normal IPv6 transmit path: net_ipv6_prepare_for_send() (called from net_if.c) invokes net_ipv6_send_ns() for any outbound or forwarded IPv6 packet whose next hop is not yet in the neighbor cache. An on-link (adjacent) attacker can drive it deterministically by sending a burst of request packets (for example ICMPv6 echo requests or UDP datagrams) that all spoof a single non-existent on-link source address: the node generates a reply to each, the first reply queues an NS, and every subsequent reply during the roughly three-second INCOMPLETE resolution window takes the leaking branch and loses one TX packet. Router-configured nodes forwarding attacker traffic toward a non-existent on-link host leak identically. Because the leaked packets are never reclaimed and CONFIG_NET_PKT_TX_COUNT defaults to only 4 (14 for Ethernet), a brief low-rate burst exhausts the TX pool. Once exhausted the node can no longer allocate any transmit packet and cannot send TCP/UDP, ARP/ND, or any reply at all, producing a complete and persistent network denial of service that does not self-heal until reboot. The fix releases the unsent NS packet with net_pkt_unref(pkt) before the early return.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-31
Last Modified
2026-08-31
Generated
2026-09-01
AI Q&A
2026-08-31
EPSS Evaluated
N/A
NVD
CVE-2026-14697
EUVD
EUVD-2026-68744

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
zephyrproject zephyr *
zephyrproject zephyr From 4.3.0 (inc) to 4.4.2 (exc)
zephyrproject zephyr 4.4.2

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-401 The product does not sufficiently track and release allocated memory after it has been used, making the memory unavailable for reallocation and reuse.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-14697 is a memory leak vulnerability in Zephyr RTOS's IPv6 network stack. The issue occurs in the net_ipv6_send_ns() function where a transmit net_pkt for a Neighbor Solicitation (NS) packet is allocated but not released if the neighbor's pending_queue is already non-empty. This causes permanent leakage of the NS net_pkt and its TX buffers, exhausting the TX pool which defaults to only 4 packets.

Detection Guidance

Monitor for sudden exhaustion of TX packet pools (CONFIG_NET_PKT_TX_COUNT) on Zephyr RTOS devices. Check for repeated Neighbor Solicitation (NS) packet allocations without corresponding transmissions. Use network traffic analysis tools to detect bursts of ICMPv6 echo requests or UDP datagrams with spoofed non-existent on-link source addresses targeting IPv6 nodes.

Impact Analysis

An adjacent attacker can exploit this by sending a burst of spoofed packets with a non-existent source address. This triggers repeated allocation and leakage of NS packets during the three-second resolution window. Once the TX pool is exhausted, the device cannot send any packets (TCP/UDP, ARP/ND, or replies), causing a complete and persistent network denial of service until reboot.

Compliance Impact

This vulnerability causes a denial of service by exhausting network transmit resources, which could disrupt critical network functions. For GDPR, this may impact availability of data processing systems, potentially violating Article 32 requirements for resilience. For HIPAA, it could disrupt electronic protected health information transmission, affecting the Security Rule's integrity and availability requirements.

Mitigation Strategies

Upgrade Zephyr RTOS to version 4.4.2 or later where the fix is applied. If upgrading is not immediately possible, apply the patch from commit ab2670e8b5b8fcde4a699dd5cbe452abbd233289. Temporarily reduce exposure by limiting IPv6 traffic or isolating affected devices until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-14697. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart