CVE-2026-14697: IPv6 Neighbor Solicitation DoS Vulnerability

CVE-2026-14697 Overview

CVE-2026-14697 is a memory leak vulnerability [CWE-401] in the Zephyr RTOS IPv6 neighbor discovery implementation. The flaw resides in net_ipv6_send_ns() within subsys/net/ip/ipv6_nbr.c, where a freshly allocated Neighbor Solicitation (NS) net_pkt is leaked when a pending queue for an unresolved neighbor is already non-empty. Repeated triggering exhausts the finite transmit packet pool, producing a persistent network denial of service that does not self-heal until the device reboots.

Critical Impact
An on-link attacker can exhaust the Zephyr TX packet pool within seconds by spoofing traffic toward non-existent on-link addresses, permanently disabling all network communication on the target node.

Affected Products

Zephyr RTOS IPv6 networking stack (subsys/net/ip/ipv6_nbr.c)
Zephyr-based devices with CONFIG_NET_IPV6 enabled (default CONFIG_NET_PKT_TX_COUNT=4, or 14 for Ethernet)
Zephyr nodes acting as IPv6 routers forwarding traffic to on-link hosts

Discovery Timeline

2026-08-31 - CVE-2026-14697 published to NVD
2026-09-01 - Last updated in NVD database

Technical Details for CVE-2026-14697

Vulnerability Analysis

The vulnerability is a memory leak on the IPv6 transmit path in the Zephyr RTOS. When net_ipv6_prepare_for_send() in net_if.c handles an outbound or forwarded IPv6 packet whose next-hop is not yet in the neighbor cache, it invokes net_ipv6_send_ns(). This function allocates a new NS net_pkt along with its attached TX buffers.

If the target neighbor already has an outstanding NS (its pending_queue is non-empty), the function appends the caller's data packet to the queue and returns early. The freshly allocated NS packet is never handed to net_send_data() and is never released with net_pkt_unref(). The buffers are held only by a local variable and leak permanently.

Zephyr's TX pool is small by design: CONFIG_NET_PKT_TX_COUNT defaults to 4 packets (14 for Ethernet). Once exhausted, the node cannot allocate any transmit packet and loses the ability to send TCP, UDP, ARP, or Neighbor Discovery traffic. The vulnerability is classified as CWE-401 (Missing Release of Memory After Effective Lifetime).

Root Cause

The leaking branch in net_ipv6_send_ns() fails to call net_pkt_unref(pkt) before its early return when the neighbor's pending_queue already contains an entry. Because the allocated NS packet never reaches the transmit path, the reference held at allocation time is never decremented, and the buffers are never returned to CONFIG_NET_PKT_TX_COUNT and CONFIG_NET_BUF_TX_COUNT pools.

Attack Vector

An adjacent-network attacker can deterministically trigger the leak by sending a burst of request packets, such as ICMPv6 echo requests or UDP datagrams, that all spoof a single non-existent on-link source address. The target generates a reply to each request. The first reply queues an NS and enters the roughly three-second INCOMPLETE resolution window. Every subsequent reply during that window takes the leaking branch and loses one TX packet. A router-configured Zephyr node forwarding attacker traffic toward a non-existent on-link host leaks identically. A brief low-rate burst is sufficient to exhaust the pool.

// Patch: net: ipv6: fix NS packet leak when pending queue is non-empty
// Source: https://github.com/zephyrproject-rtos/zephyr/commit/ab2670e8b5b8fcde4a699dd5cbe452abbd233289

			/* Let the system timeout and then send the NS again */
			net_ipv6_nbr_unlock();
+			net_pkt_unref(pkt);
			return 0;
		}
	}

The fix adds a single net_pkt_unref(pkt) call before the early return, returning the unsent NS packet's buffers to the TX pool.

Detection Methods for CVE-2026-14697

Indicators of Compromise

Sustained bursts of ICMPv6 echo requests or UDP datagrams to a Zephyr node from a spoofed on-link source address that never responds to Neighbor Solicitations.
Rapid growth in queued NS entries for a single unresolved neighbor within the roughly three-second INCOMPLETE window.
Zephyr node stops transmitting any IPv6 or ARP/ND traffic and does not recover without reboot.

Detection Strategies

Monitor Zephyr network statistics (net stats) for depletion of the TX packet pool and abnormal counts of outstanding NS transactions.
Inspect on-link IPv6 traffic for high volumes of packets sourced from addresses that never complete neighbor resolution.
Correlate device unreachability with prior bursts of unsolicited traffic from a single peer to identify the leaking condition.

Monitoring Recommendations

Enable and export Zephyr network buffer telemetry to a central collector for long-horizon trending on TX pool utilization.
Alert on IPv6 neighbor cache entries that remain in the INCOMPLETE state with growing pending queue depth.
Watch for sudden loss of heartbeat traffic from embedded devices located on segments exposed to untrusted hosts.

How to Mitigate CVE-2026-14697

Immediate Actions Required

Apply the upstream Zephyr patch from commit ab2670e and rebuild affected firmware images.
Restrict the layer-2 segments on which vulnerable Zephyr devices are reachable, limiting exposure to trusted adjacent hosts only.
Review devices deployed as IPv6 routers, since forwarding paths also trigger the leaking branch.

Patch Information

The fix is available in the Zephyr project as commit ab2670e8b5b8fcde4a699dd5cbe452abbd233289, which adds net_pkt_unref(pkt) before the early return in net_ipv6_send_ns(). Additional context is provided in the GitHub Security Advisory GHSA-x956-p489-8mf5. Downstream vendors integrating Zephyr should rebase to a release containing the fix and reissue firmware to affected fleets.

Workarounds

Increase CONFIG_NET_PKT_TX_COUNT and CONFIG_NET_BUF_TX_COUNT to raise the attacker's cost, understanding this only delays exhaustion.
Deploy layer-2 controls such as port isolation, RA guard, and ND rate limiting on switches serving Zephyr devices.
Where feasible, disable IPv6 forwarding on Zephyr nodes that do not require router functionality.

bash

# Zephyr build configuration example - raise TX pool sizing as a stopgap
CONFIG_NET_PKT_TX_COUNT=32
CONFIG_NET_BUF_TX_COUNT=64