Zephyr Ethernet Bridge RX Buffer-Exhaustion DoS (CVE-2025-14366/GHSA-3m5w-wcvv-766q)

Summary of Key Vulnerability Information Vulnerability Overview Title: Ethernet bridge RX packet leak enables denial of service via RX buffer-pool exhaustion ID: GHSA-3m5w-wcvv-766q Severity: Moderate (CVSS 6.5/10, Vector ) Description: When Ethernet bridging is enabled ( ), handles every frame received on a bridge member interface. If the frame's EtherType has no registered L3 handler ( not set), only is called and is returned without taking ownership of . The path calls , but the non-consumer does not actually take over , causing to not be freed, resulting in a memory leak. An attacker can exhaust the RX buffer pool by sending broadcast/multicast frames with arbitrary EtherTypes, leading to a persistent denial of service (DoS). Affected Scope Affected Component: Affected Versions: Fixed In: Attack Vector: Local, no authentication required, low complexity, high impact (Availability) Fix Details Fix Version: 4.4.2 (first release to include the fix) Fix Commit: ("net: bridge: handle RX in bridge_input.c") Fix Content: Enables to properly take over for locally received frames and return , allowing the packet to follow the normal receive path and avoiding the leak. Patch Status: - branch: PR #11391 (merged) - : PR #135524 (merged) Evidence (Key Code Paths) (pre-fix): The broadcast/multicast and unicast-to-bridge branches call and then return (the leak point) (pre-fix): calls but discards the return value and never consumes : returns but does not take ownership : The path in does not free : survives only when an L3 handler is missing : L2 dispatch message queue (IPv4/IPv6/ARP) : When is not set, enables the leak path : selects and as the overall gating conditions Introducing Commit: (merged in v4.4.0 and v4.4.1, cannot be fixed in those versions) Other Information CVE: CVE-2025-14366 Weakness: CWE-401 (Resource Leak) Embargo Deadline: 2026-08-31

Goal Reached Thanks to every supporter — we hit 100%!

Zephyr Ethernet Bridge RX Buffer-Exhaustion DoS (CVE-2025-14366/GHSA-3m5w-wcvv-766q)

More from this source