CVE-2026-14697

net_ipv6_send_ns() in subsys/net/ip/ipv6_nbr.c allocates a transmit net_pkt for a Neighbor Solicitation. When it is called with a data packet pending on an unresolved neighbor and that neighbor's pending_queue is already non-empty (an NS is already outstanding), the function appends the data packet and returns early without ever sending the NS via net_send_data() or releasing it with net_pkt_unref(). The freshly allocated NS net_pkt and its attached TX buffers are held only by a local variable and are leaked permanently, never returning to CONFIG_NET_PKT_TX_COUNT / CONFIG_NET_BUF_TX_COUNT. The leaking branch sits on the normal IPv6 transmit path: net_ipv6_prepare_for_send() (called from net_if.c) invokes net_ipv6_send_ns() for any outbound or forwarded IPv6 packet whose next hop is not yet in the neighbor cache. An on-link (adjacent) attacker can drive it deterministically by sending a burst of request packets (for example ICMPv6 echo requests or UDP datagrams) that all spoof a single non-existent on-link source address: the node generates a reply to each, the first reply queues an NS, and every subsequent reply during the roughly three-second INCOMPLETE resolution window takes the leaking branch and loses one TX packet. Router-configured nodes forwarding attacker traffic toward a non-existent on-link host leak identically. Because the leaked packets are never reclaimed and CONFIG_NET_PKT_TX_COUNT defaults to only 4 (14 for Ethernet), a brief low-rate burst exhausts the TX pool. Once exhausted the node can no longer allocate any transmit packet and cannot send TCP/UDP, ARP/ND, or any reply at all, producing a complete and persistent network denial of service that does not self-heal until reboot. The fix releases the unsent NS packet with net_pkt_unref(pkt) before the early return.

• CWE-401

• https://github.com/zephyrproject-rtos/zephyr/commit/ab2670e8b5b8fcde4a699dd5cbe452abbd233289
• https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-x956-p489-8mf5

Published

Aug 31, 2026

Last Modified

Aug 31, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-14691A security vulnerability has been detected in SourceCodester…6.3
• CVE-2026-14692A vulnerability was detected in SourceCodester Multi-Vendor …6.3
• CVE-2026-14693A flaw has been found in SourceCodester Multi-Vendor Online …5.4
• CVE-2026-14694A vulnerability has been found in SourceCodester Multi-Vendo…6.3
• CVE-2026-14695A vulnerability was found in SourceCodester Multi-Vendor Onl…7.3
• CVE-2026-14696When Ethernet bridging is enabled (CONFIG_NET_ETHERNET_BRIDG…6.5
• CVE-2026-14698A security flaw has been discovered in SourceCodester Syllab…6.3
• CVE-2026-14699A weakness has been identified in zcaceres markdownify-mcp u…4.8
• CVE-2026-1470n8n contains a critical Remote Code Execution (RCE) vulnerab…9.9
• CVE-2026-14700A security vulnerability has been detected in code-projects …7.3
• CVE-2026-14701A vulnerability was detected in code-projects Internship Man…6.3
• CVE-2026-14702A flaw has been found in zcaceres markdownify-mcp up to 1.1.…2.5