---
id: CVE-2026-14697
title: >-
  IPv6 Neighbor Solicitation packet leak causes TX pool exhaustion denial of
  service
summary: >-
  net_ipv6_send_ns() in subsys/net/ip/ipv6_nbr.c allocates a transmit net_pkt
  for a Neighbor Solicitation. When it is called with a data packet pending on
  an unresolved neighbor and that neighbor's pending_queue is already non-empty
  (an NS…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
cvssSource: cna
cwe:
  - CWE-401
vendor: zephyrproject
product: zephyr
affected:
  - zephyr >= 4.3.0 < 4.3.2
  - zephyr >= 4.4.0 < 4.4.2
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-01T13:58:23.543324Z'
published: '2026-08-31'
updated: '2026-11-04'
sourceUpdated: '2026-11-04T05:00:06.805Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-14697'
references:
  - url: >-
      https://github.com/zephyrproject-rtos/zephyr/commit/ab2670e8b5b8fcde4a699dd5cbe452abbd233289
    label: Fix commit
  - url: >-
      https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-x956-p489-8mf5
    label: GHSA-x956-p489-8mf5
tags:
  - cve.org
epss: 0.00285
epssPercentile: 0.21127
ingestedAt: '2026-11-05T20:33:06.710Z'
---

## Overview

net_ipv6_send_ns() in subsys/net/ip/ipv6_nbr.c allocates a transmit net_pkt for a Neighbor Solicitation. When it is called with a data packet pending on an unresolved neighbor and that neighbor's pending_queue is already non-empty (an NS is already outstanding), the function appends the data packet and returns early without ever sending the NS via net_send_data() or releasing it with net_pkt_unref(). The freshly allocated NS net_pkt and its attached TX buffers are held only by a local variable and are leaked permanently, never returning to CONFIG_NET_PKT_TX_COUNT / CONFIG_NET_BUF_TX_COUNT.

The leaking branch sits on the normal IPv6 transmit path: net_ipv6_prepare_for_send() (called from net_if.c) invokes net_ipv6_send_ns() for any outbound or forwarded IPv6 packet whose next hop is not yet in the neighbor cache. An on-link (adjacent) attacker can drive it deterministically by sending a burst of request packets (for example ICMPv6 echo requests or UDP datagrams) that all spoof a single non-existent on-link source address: the node generates a reply to each, the first reply queues an NS, and every subsequent reply during the roughly three-second INCOMPLETE resolution window takes the leaking branch and loses one TX packet. Router-configured nodes forwarding attacker traffic toward a non-existent on-link host leak identically.

Because the leaked packets are never reclaimed and CONFIG_NET_PKT_TX_COUNT defaults to only 4 (14 for Ethernet), a brief low-rate burst exhausts the TX pool. Once exhausted the node can no longer allocate any transmit packet and cannot send TCP/UDP, ARP/ND, or any reply at all, producing a complete and persistent network denial of service that does not self-heal until reboot. The fix releases the unsent NS packet with net_pkt_unref(pkt) before the early return.

## Affected

- `zephyr >= 4.3.0 < 4.3.2`
- `zephyr >= 4.4.0 < 4.4.2`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.