CVE-2026-14697

Name of the Vulnerable Software and Affected Versions The product name cannot be determined (affected versions not specified)

Description A memory leak occurs in the net ipv6 send ns() function within subsys/net/ip/ipv6 nbr.c when allocating a transmit net pkt for a Neighbor Solicitation. If the function is called while a data packet is pending on an unresolved neighbor and the pending queue is already non-empty, the function appends the data packet and returns early. This process fails to send the NS via net send data() or release it using net pkt unref(), causing the net pkt and its attached TX buffers to be leaked permanently.

This issue is triggered on the IPv6 transmit path when net ipv6 prepare for send() invokes net ipv6 send ns() for packets whose next hop is not in the neighbor cache. An adjacent attacker can exploit this by sending a burst of request packets spoofing a single non-existent on-link source address. This exhausts the TX pool, as defined by CONFIG NET PKT TX COUNT and CONFIG NET BUF TX COUNT, leading to a persistent network denial of service where the node cannot send any TCP, UDP, ARP, or ND traffic until a reboot occurs.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.