Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-14697— IPv6 Neighbor Solicitation packet leak causes TX pool exhaustion denial of service

Quick assessment

Affected
zephyrproject zephyr
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

zephyrproject Zephyr是zephyrproject组织开源的一款面向物联网设备的实时操作系统。 zephyrproject Zephyr 4.3.0版本至4.4.2之前版本存在资源管理错误漏洞，该漏洞源于subsys/net/ip/ipv6_nbr.c中的net_ipv6_send_ns()函数在邻居解析未完成且待处理队列非空时，未发送邻居请求也未释放分配的net_pkt，导致内存泄漏，攻击者可通过发送突发ICMPv6或UDP请求包耗尽传输池，造成持久拒绝服务。

CVSS 6.5 · Medium EPSS 0.18% · P6

Affected Version Matrix 1

VendorProduct Version RangeStatus
zephyrproject zephyr 4.3.0< 4.4.2 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-14697

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
IPv6 Neighbor Solicitation packet leak causes TX pool exhaustion denial of service
Source: CVE Program / CVE List V5
Vulnerability Description
net_ipv6_send_ns() in subsys/net/ip/ipv6_nbr.c allocates a transmit net_pkt for a Neighbor Solicitation. When it is called with a data packet pending on an unresolved neighbor and that neighbor's pending_queue is already non-empty (an NS is already outstanding), the function appends the data packet and returns early without ever sending the NS via net_send_data() or releasing it with net_pkt_unref(). The freshly allocated NS net_pkt and its attached TX buffers are held only by a local variable and are leaked permanently, never returning to CONFIG_NET_PKT_TX_COUNT / CONFIG_NET_BUF_TX_COUNT. The leaking branch sits on the normal IPv6 transmit path: net_ipv6_prepare_for_send() (called from net_if.c) invokes net_ipv6_send_ns() for any outbound or forwarded IPv6 packet whose next hop is not yet in the neighbor cache. An on-link (adjacent) attacker can drive it deterministically by sending a burst of request packets (for example ICMPv6 echo requests or UDP datagrams) that all spoof a single non-existent on-link source address: the node generates a reply to each, the first reply queues an NS, and every subsequent reply during the roughly three-second INCOMPLETE resolution window takes the leaking branch and loses one TX packet. Router-configured nodes forwarding attacker traffic toward a non-existent on-link host leak identically. Because the leaked packets are never reclaimed and CONFIG_NET_PKT_TX_COUNT defaults to only 4 (14 for Ethernet), a brief low-rate burst exhausts the TX pool. Once exhausted the node can no longer allocate any transmit packet and cannot send TCP/UDP, ARP/ND, or any reply at all, producing a complete and persistent network denial of service that does not self-heal until reboot. The fix releases the unsent NS packet with net_pkt_unref(pkt) before the early return.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
在移除最后引用时对内存的释放不恰当(内存泄露)
Source: CVE Program / CVE List V5
Vulnerability Title
zephyrproject Zephyr 资源管理错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
zephyrproject Zephyr是zephyrproject组织开源的一款面向物联网设备的实时操作系统。 zephyrproject Zephyr 4.3.0版本至4.4.2之前版本存在资源管理错误漏洞，该漏洞源于subsys/net/ip/ipv6_nbr.c中的net_ipv6_send_ns()函数在邻居解析未完成且待处理队列非空时，未发送邻居请求也未释放分配的net_pkt，导致内存泄漏，攻击者可通过发送突发ICMPv6或UDP请求包耗尽传输池，造成持久拒绝服务。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
zephyrproject zephyr 4.3.0 ~ 4.4.2 -

II. Public POCs for CVE-2026-14697

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-14697

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-14697 (1)

Vendor Advisories for CVE-2026-14697 (1)

Same Patch Batch · zephyrproject · 2026-08-31 · 5 CVEs total

CVE-2026-14696 6.5 MEDIUM Ethernet bridge RX packet leak enables denial of service via RX buffer-pool exhaustion
CVE-2026-14366 6.4 MEDIUM SiWx91x WiFi driver double-unref / use-after-free of caller-owned TX net_pkt
CVE-2026-14368 5.4 MEDIUM Off-by-one out-of-bounds NUL write in Zephyr LwM2M JSON string parser
CVE-2026-14367 3.1 LOW I3C IBI work-node free-list data race between ISR and workqueue thread

IV. Related Vulnerabilities

Same product: zephyr
Same vendor: zephyrproject
Same weakness: CWE-401

V. Comments for CVE-2026-14697

No comments yet

Leave a comment