Executive brief
Zephyr is an open-source operating system designed for resource-constrained Internet of Things (IoT) devices. A flaw in its networking software allows a remote attacker to crash the device's ability to communicate by sending a small number of specially crafted data packets. This results in a permanent loss of network connectivity for the device until it is manually reset, potentially disrupting critical industrial or consumer operations.
Technical details
A resource leak exists in Zephyr's IPv6 fragmentation handling logic (CWE-772). When the network stack processes a maliciously fragmented IPv6 packet through the fragment-header processing path, the associated RX network packet buffer (allocated from a memory slab) is not released back to the pool. An unauthenticated remote attacker can exploit this by sending a sequence of these packets to exhaust all available RX buffer slots. Once the buffer pool is exhausted, the device can no longer allocate memory for new incoming traffic, resulting in a persistent denial-of-service (DoS) state. The vulnerability is confirmed in versions up to 4.3 and has been addressed in subsequent patches.
Affected products
- Zephyr Project Zephyr <= 4.3
Timeline
- 2026-05-12: other: Embargo date
- 2026-06-25: advisory: GHSA-cv4q-2j56-4wqf published
- 2026-06-25: disclosed: CVE-2026-13351 published