Zephyr RTOS CVE-2026-14697

IPv6 must be enabled in the Zephyr build and Neighbor Discovery must be active - both are default for any IPv6-capable Zephyr configuration, so no non-default setup is required beyond having IPv6 compiled in. The attacker must be on the same L2 network segment as the target (AV:A); this adjacency requirement is the primary practical barrier. The exploit is driven by sending packets whose destination triggers outbound replies from the Zephyr node toward a spoofed or non-existent on-link source address, so the attacker needs only the ability to inject arbitrary L2 frames. No authentication is required (PR:N). The leak rate is bounded by how quickly the target generates outbound packets during the ~3-second INCOMPLETE Neighbor Discovery resolution window; with the default CONFIG_NET_PKT_TX_COUNT=4, exhaustion requires as few as four leaked packets. The denial of service does not self-heal - the device cannot recover without reboot. Router-configured Zephyr nodes forwarding traffic toward a non-existent on-link host are equally vulnerable without requiring source-address spoofing.

The CVSS 6.5 (AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) accurately captures the threat model. Adjacent-network positioning (AV:A) is the dominant limiting factor: the attacker must be on the same L2 segment, ruling out arbitrary internet-sourced exploitation. Within that constraint, the attack is mechanically trivial (AC:L, PR:N) and fully deterministic - the attacker controls the leak rate precisely. The availability impact (A:H) is accurately rated High: exhaustion of the default 4-packet TX pool produces a complete, non-self-healing network outage requiring physical reboot, which is operationally severe for unattended IoT and embedded deployments. No EPSS score was provided in the input data, so probability-based risk comparison is unavailable. The vulnerability is not listed in CISA KEV and no public exploit code has been identified, suggesting no observed active exploitation at time of writing. Despite the moderate numerical CVSS score, the real-world criticality is elevated for any Zephyr deployment in a shared or hostile L2 environment (factory floors, shared Wi-Fi, public infrastructure) where adjacent access cannot be controlled. For isolated dedicated segments, AV:A meaningfully reduces exposure.

An attacker connected to the same Ethernet or Wi-Fi segment as a Zephyr device sends a rapid burst of ICMPv6 echo requests or UDP datagrams with a spoofed source address that appears on-link but resolves to no real host. The Zephyr node generates a reply for each, triggers NS generation for the spoofed address on the first, and leaks one TX net_pkt for every subsequent reply during the approximately three-second INCOMPLETE resolution window. With the default pool of four TX packets, four such iterations exhaust the pool and the device silently stops transmitting any traffic - TCP connections stall, ARP/ND probes are not sent, and the node appears dead on the network until rebooted. No public proof-of-concept has been identified, but the mechanics are straightforward for any attacker with L2 adjacency.