Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-14697— IPv6 Neighbor Solicitation packet leak causes TX pool exhaustion denial of service

Quick assessment

Affected
zephyrproject zephyr
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

中的 函数用于为邻居请求（Neighbor Solicitation, NS）分配一个发送用的网络数据包（net_pkt）。当该函数在存在未解析邻居且有数据报等待发送时被调用，且该邻居的 非空（即已有一个未决的 NS），该函数会将数据报追加到队列中并提前返回，但从未通过 发送该 NS，也未通过 释放它。新分配的 NS 数据包及其附带的 TX 缓冲区仅由局部变量持有，从而导致永久性内存泄漏，永远不会归还到 / 池中。 该泄漏分支位于常规的 IPv6 发送路径上： （由 调用）对于下一跳尚未进入邻居缓存的任何出站或转发

CVSS 6.5 · Medium
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-14697

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
IPv6 Neighbor Solicitation packet leak causes TX pool exhaustion denial of service
Source: CVE Program / CVE List V5
Vulnerability Description
net_ipv6_send_ns() in subsys/net/ip/ipv6_nbr.c allocates a transmit net_pkt for a Neighbor Solicitation. When it is called with a data packet pending on an unresolved neighbor and that neighbor's pending_queue is already non-empty (an NS is already outstanding), the function appends the data packet and returns early without ever sending the NS via net_send_data() or releasing it with net_pkt_unref(). The freshly allocated NS net_pkt and its attached TX buffers are held only by a local variable and are leaked permanently, never returning to CONFIG_NET_PKT_TX_COUNT / CONFIG_NET_BUF_TX_COUNT. The leaking branch sits on the normal IPv6 transmit path: net_ipv6_prepare_for_send() (called from net_if.c) invokes net_ipv6_send_ns() for any outbound or forwarded IPv6 packet whose next hop is not yet in the neighbor cache. An on-link (adjacent) attacker can drive it deterministically by sending a burst of request packets (for example ICMPv6 echo requests or UDP datagrams) that all spoof a single non-existent on-link source address: the node generates a reply to each, the first reply queues an NS, and every subsequent reply during the roughly three-second INCOMPLETE resolution window takes the leaking branch and loses one TX packet. Router-configured nodes forwarding attacker traffic toward a non-existent on-link host leak identically. Because the leaked packets are never reclaimed and CONFIG_NET_PKT_TX_COUNT defaults to only 4 (14 for Ethernet), a brief low-rate burst exhausts the TX pool. Once exhausted the node can no longer allocate any transmit packet and cannot send TCP/UDP, ARP/ND, or any reply at all, producing a complete and persistent network denial of service that does not self-heal until reboot. The fix releases the unsent NS packet with net_pkt_unref(pkt) before the early return.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
在移除最后引用时对内存的释放不恰当(内存泄露)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
zephyrproject zephyr 4.3.0 ~ 4.4.2 -

II. Public POCs for CVE-2026-14697

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-14697

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-14697 (1)

Vendor Advisories for CVE-2026-14697 (1)

Same Patch Batch · zephyrproject · 2026-08-31 · 5 CVEs total

CVE-2026-14696 6.5 MEDIUM Ethernet bridge RX packet leak enables denial of service via RX buffer-pool exhaustion
CVE-2026-14366 6.4 MEDIUM SiWx91x WiFi driver double-unref / use-after-free of caller-owned TX net_pkt
CVE-2026-14368 5.4 MEDIUM Off-by-one out-of-bounds NUL write in Zephyr LwM2M JSON string parser
CVE-2026-14367 3.1 LOW I3C IBI work-node free-list data race between ISR and workqueue thread

IV. Related Vulnerabilities

Same product: zephyr
Same vendor: zephyrproject
Same weakness: CWE-401

V. Comments for CVE-2026-14697

No comments yet

Leave a comment