CVE-2026-14697 zephyrproject CVE debrief

Who should care

Network administrators and security teams responsible for managing and securing Zephyr-based systems should assess their exposure and take necessary actions to mitigate this vulnerability.

Why it matters

This vulnerability can cause a network denial of service in Zephyr-based systems. Network administrators and security teams should assess their exposure and take necessary actions to mitigate this vulnerability.

• Network denial of service: an attacker can cause a node to exhaust its transmit pool, leading to a complete and persistent network denial of service.
• Verification priority: verifying that CONFIG_NET_PKT_TX_COUNT and CONFIG_NET_BUF_TX_COUNT are properly configured can help prevent this vulnerability.

Technical summary

The net_ipv6_send_ns() function in subsys/net/ip/ipv6_nbr.c allocates a transmit net_pkt for a Neighbor Solicitation. When it is called with a data packet pending on an unresolved neighbor and that neighbor's pending_queue is already non-empty, the function appends the data packet and returns early without ever sending the NS via net_send_data() or releasing it with net_pkt_unref(). This results in a memory leak, as the freshly allocated NS net_pkt and its attached TX buffers are held only by a local variable and are leaked permanently, never returning to CONFIG_NET_PKT_TX_COUNT / CONFIG_NET_BUF_TX_COUNT. An on-link attacker can drive it deterministically by sending a burst of request packets that all spoof a

Defensive priority

High

Recommended defensive actions

• Review and apply the patch provided by the vendor
• Implement rate limiting on incoming IPv6 packets
• Monitor network traffic for suspicious activity
• Verify that CONFIG_NET_PKT_TX_COUNT and CONFIG_NET_BUF_TX_COUNT are properly configured
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.

Evidence notes

The vulnerability is caused by a memory leak in the net_ipv6_send_ns() function. When the function is called with a data packet pending on an unresolved neighbor and that neighbor's pending_queue is already non-empty, the function appends the data packet and returns early without ever sending the NS via net_send_data() or releasing it with net_pkt_unref().

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.