Zephyr RTOS EUVD-2026-68728

Exploitation requires three specific conditions: (1) The target Zephyr firmware is compiled with CONFIG_NET_ETHERNET_BRIDGE=y - this is a non-default Kconfig option that must be explicitly selected by the firmware developer. (2) CONFIG_NET_ETHERNET_FORWARD_UNRECOGNISED_ETHERTYPE is enabled, which is the default when CONFIG_NET_SOCKETS_PACKET is selected; this is the trigger for the most concretely reproducible and deterministic leak path. (3) The attacker must have a device physically or logically connected to the same L2 Ethernet segment as the bridged interface - Layer 3 routing across network boundaries is not sufficient. No authentication is required once adjacency is achieved; any device capable of transmitting standard Ethernet frames on the segment can exploit this. The primary limiting factor for real-world exposure is L2 adjacency: internet-facing exploitation without prior network access is not possible.

The CVSS 3.1 vector AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (score 6.5) accurately models the threat: exploitation is bounded by L2 adjacency but requires no authentication and no user interaction once on-segment. The High availability rating is justified because buffer pool exhaustion is persistent - the device silently stops receiving all traffic and requires a reboot to recover, which is a significant operational impact for embedded controllers managing physical processes or communications infrastructure. No EPSS score is present in the input and this CVE is not listed in CISA KEV, indicating no confirmed widespread or active exploitation at time of analysis. Attack complexity is genuinely low once adjacency is established, so the primary real-world limiter is network topology: deployments where untrusted devices can join the bridged L2 segment face meaningful risk, while air-gapped or access-controlled segments substantially reduce exposure. No POC code is confirmed in the available data. Overall, this is a legitimate medium-severity issue whose urgency scales directly with whether untrusted L2 peers can reach the bridged interface.

An attacker with a device on the same Ethernet segment as a Zephyr gateway compiled with Ethernet bridging enabled crafts a high-rate broadcast flood of frames carrying EtherType values not registered with any L3 handler. Each frame permanently consumes one buffer from the device's fixed-size RX pool without triggering any visible error. After exhausting the pool - achievable in seconds at typical Ethernet rates - the device silently stops processing all incoming network traffic until it is rebooted.