CVE-2026-14696

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-14696
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-14696.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-14696
Aliases
  • GHSA-3m4w-wc4v-766q
Published
2026-08-31T18:57:06Z
Modified
2026-09-03T08:07:08Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
Ethernet bridge RX packet leak enables denial of service via RX buffer-pool exhaustion
Details

When Ethernet bridging is enabled (CONFIG_NET_ETHERNET_BRIDGE), eth_bridge_input_process() in subsys/net/l2/ethernet/bridge/bridge_input.c decides how each frame received on a bridge member interface is handled. For frames that must also be delivered to the local stack, the code called eth_bridge_handle_locally() and returned NET_OK. That helper does not consume the packet — it only calls bridge_iface_recv() (via virtual_recv()), which returns NET_CONTINUE without taking ownership of pkt.

The NET_OK verdict then propagates through ethernet_recv() up to processing_data() in subsys/net/ip/net_core.c, where NET_OK is interpreted as "the packet was consumed, do not free it." Because no consumer actually took ownership, the RX net_pkt is never returned to the pool and is leaked. The concretely reproducible leak occurs for frames whose EtherType has no registered L3 handler when CONFIG_NET_ETHERNET_FORWARD_UNRECOGNISED_ETHERTYPE is set (default y when CONFIG_NET_SOCKETS_PACKET is enabled): the fall-through L3 dispatch does not overwrite the NET_OK verdict, so ethernet_recv() returns NET_OK and the buffer is never released.

Any device on a bridged L2 segment can emit broadcast/multicast frames carrying an arbitrary EtherType with no authentication. Each such frame permanently consumes one buffer from the finite RX pool (CONFIG_NET_PKT_RX_COUNT), so a brief broadcast flood exhausts the pool and the device can no longer receive traffic until it is rebooted — a persistent denial of service. There is no confidentiality or integrity impact.

The fix makes eth_bridge_handle_locally() propagate the real net_verdict and return NET_CONTINUE for locally-kept frames, writing the bridge interface back through a new dst_iface out-parameter so the packet follows the normal receive path and is unreferenced exactly once.

Database specific 
{
    "cna_assigner":  "zephyr",
    "cwe_ids":  [
        "CWE-401"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/14xxx/CVE-2026-14696.json"
}
References

Affected packages

Git / github.com/zephyrproject-rtos/zephyr

Affected ranges

Type
GIT
Repo
https://github.com/zephyrproject-rtos/zephyr
Events
Introduced
684c9e8f32e4373a21098559f748f06915f950c9
Fixed
4eb007af465a1d28f2f35d93ecf139cc62c542a7
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "4.4.0"
        },
        {
            "fixed":  "4.4.2"
        }
    ],
    "source":  [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

v4.*
v4.4.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-14696.json"
vanir_signatures 
[
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "178243550905509610504895054849702584088",
            "length":  411
        },
        "id":  "CVE-2026-14696-2398e998",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/zephyrproject-rtos/zephyr/commit/4eb007af465a1d28f2f35d93ecf139cc62c542a7",
        "target":  {
            "file":  "subsys/net/l2/ethernet/bridge/bridge_input.c",
            "function":  "eth_bridge_handle_locally"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "120705168840692625303709596167501560621",
                "140185408478339519338071855905329116161",
                "9746431515891233157849854345039344696",
                "160995344505454491493441912992312872135",
                "232506514414997224664252425653648937391",
                "12928447911990419443478352772744513454",
                "239984005106718783252474285997187592536",
                "150838593891777999993062708394229877306",
                "334251870856953052381130842430744049893",
                "24176519424457494054946473609223070914",
                "76269281695831461801643564025074679523",
                "145574817741007418636067603390053635850",
                "55610733974268756340903417646916543092",
                "315297764493019680029647061223872528043",
                "267868390585593816517915983992887850017",
                "167209391117043802373861165735576969686",
                "232819156379520175737864515261858228035",
                "335570984850408253564659187020765606790",
                "8947657881381843965299074544588608986",
                "253924529708140083978414822127303260140",
                "29797197291469060405039032388249614058",
                "128604930205786765057159669836897167183",
                "279180708747428306507722521790489871982",
                "155936180528092221718861027898634301033",
                "19077073952822478812143287529747825196",
                "306996179716146811599348534809884127191",
                "98880554240792600851013306236265956585",
                "67321139929719252608758556091569288689",
                "283854251222459935825005690768829735756",
                "137786945721016691984425942928765862513",
                "294689768735629251578024770859561994704",
                "133101769821518114074721841232573636075",
                "282206898586514708041032077451963584385",
                "197855240402713997451652241479683575037",
                "264618161365679694574901069709260734043",
                "272605217139939996643201430668477473451",
                "297637450950494277280011469594889923013",
                "146141099933766860904122205211002217652",
                "281293379721433549309423350633688012515",
                "97066965938480785035373634545746723128",
                "37692091291730728866327704872885664991",
                "148585253966116387231965889842019249903",
                "154633437174118878889250828137284470506",
                "146141099933766860904122205211002217652",
                "281293379721433549309423350633688012515",
                "41623091945917294993653861683624901356",
                "210609650841049278203033589441363030984",
                "164624034028634104020263577501267096656"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-14696-51bdbb6c",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/zephyrproject-rtos/zephyr/commit/4eb007af465a1d28f2f35d93ecf139cc62c542a7",
        "target":  {
            "file":  "subsys/net/l2/ethernet/bridge/bridge_input.c"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "95425391598362615399653810308229241247",
            "length":  923
        },
        "id":  "CVE-2026-14696-86b2bf70",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/zephyrproject-rtos/zephyr/commit/4eb007af465a1d28f2f35d93ecf139cc62c542a7",
        "target":  {
            "file":  "subsys/net/l2/ethernet/bridge/bridge_input.c",
            "function":  "eth_bridge_input_process"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "285432674285042314141847857336472088325",
            "length":  3185
        },
        "id":  "CVE-2026-14696-8f3a8dd4",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/zephyrproject-rtos/zephyr/commit/4eb007af465a1d28f2f35d93ecf139cc62c542a7",
        "target":  {
            "file":  "subsys/net/l2/ethernet/ethernet.c",
            "function":  "ethernet_recv"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "173725945873527262203524448773265986610",
                "30213875435359620761023939499429405979",
                "327665654562419863507282783884285592292",
                "162574352016518940079181892810075833979",
                "159758152616313202694445954628315453320",
                "324482256285756633220075532686289893854",
                "230033328511368044801048438664114391153",
                "330739361129644963312790093112510210539",
                "36683539276037562949669456179363058150",
                "183865488920191531244679165531190837067"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-14696-9a0800e0",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/zephyrproject-rtos/zephyr/commit/4eb007af465a1d28f2f35d93ecf139cc62c542a7",
        "target":  {
            "file":  "subsys/net/l2/ethernet/ethernet.c"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "141793912780291394533798469489614230515",
                "146155474272357091671892189504966504506",
                "169095876503668506077853258582684950597",
                "55654346696072770008197542414927695386"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-14696-d49d0315",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/zephyrproject-rtos/zephyr/commit/4eb007af465a1d28f2f35d93ecf139cc62c542a7",
        "target":  {
            "file":  "include/zephyr/net/ethernet_bridge.h"
        }
    }
]
vanir_signatures_modified 
"2026-09-03T08:07:08Z"