Executive brief
Zephyr RTOS, an embedded operating system kernel widely used in IoT and networked devices, contains a memory leak in its IPv6 neighbor discovery mechanism. When the system attempts to resolve neighboring devices on a network, it can fail to clean up temporary network packets under certain conditions, causing the transmit packet pool to become exhausted. An attacker on the same network segment can trigger this leak repeatedly by sending spoofed packets, causing the device to stop responding to all network traffic and requiring a manual reboot to recover.
Technical details
The vulnerability is a resource leak in the net_ipv6_send_ns() function in subsys/net/ip/ipv6_nbr.c. When handling IPv6 Neighbor Solicitation (NS) packets, the function allocates a transmit net_pkt but fails to release it via net_pkt_unref() in an early-return code path when a pending_queue is non-empty. This occurs when a second data packet arrives for a neighbor whose address resolution is already in progress. An on-link adjacent attacker can trigger this leak deterministically by sending bursts of spoofed IPv6 packets with a non-existent source address; each reply attempt during the three-second INCOMPLETE resolution window leaks one TX packet. Since CONFIG_NET_PKT_TX_COUNT defaults to only 4 packets (or 14 for Ethernet), the TX pool exhausts after a brief attack, causing complete network denial of service that persists until the device reboots. The fix is a simple net_pkt_unref(pkt) call before the early return.
Affected products
- Zephyr Project Zephyr RTOS versions prior to the fix (exact version range not specified in advisory)
Timeline
- 2026-08-31: disclosed