CVE-2026-14696

Name of the Vulnerable Software and Affected Versions The product name cannot be determined (affected versions not specified)

Description A memory leak occurs when Ethernet bridging is enabled via CONFIG NET ETHERNET BRIDGE. The function eth bridge input process() in subsys/net/l2/ethernet/bridge/bridge input.c incorrectly returns a NET OK verdict when calling eth bridge handle locally(), even though the packet is not actually consumed. This verdict propagates to processing data() in subsys/net/ip/net core.c, which interprets NET OK as a signal that the packet was consumed and should not be freed. Consequently, the net pkt is never returned to the RX pool.

This issue is specifically reproducible for frames with an EtherType that has no registered L3 handler when CONFIG NET ETHERNET FORWARD UNRECOGNISED ETHERTYPE is enabled. An unauthenticated attacker on a bridged L2 segment can send broadcast or multicast frames with arbitrary EtherTypes to exhaust the finite RX pool (CONFIG NET PKT RX COUNT), resulting in a persistent denial of service where the device cannot receive traffic until it is rebooted.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.