CVE-2026-14696

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-14696

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-14696.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-14696

Aliases

GHSA-3m4w-wc4v-766q

Published

2026-08-31T18:57:06.627Z

Modified

2026-09-03T08:07:08.285422Z

Severity

6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator

Summary

Ethernet bridge RX packet leak enables denial of service via RX buffer-pool exhaustion

Details

When Ethernet bridging is enabled (CONFIGNETETHERNETBRIDGE), ethbridgeinputprocess() in subsys/net/l2/ethernet/bridge/bridgeinput.c decides how each frame received on a bridge member interface is handled. For frames that must also be delivered to the local stack, the code called ethbridgehandlelocally() and returned NETOK. That helper does not consume the packet — it only calls bridgeifacerecv() (via virtualrecv()), which returns NET_CONTINUE without taking ownership of pkt.

The NETOK verdict then propagates through ethernetrecv() up to processingdata() in subsys/net/ip/netcore.c, where NETOK is interpreted as "the packet was consumed, do not free it." Because no consumer actually took ownership, the RX netpkt is never returned to the pool and is leaked. The concretely reproducible leak occurs for frames whose EtherType has no registered L3 handler when CONFIGNETETHERNETFORWARDUNRECOGNISEDETHERTYPE is set (default y when CONFIGNETSOCKETSPACKET is enabled): the fall-through L3 dispatch does not overwrite the NETOK verdict, so ethernetrecv() returns NET_OK and the buffer is never released.

Any device on a bridged L2 segment can emit broadcast/multicast frames carrying an arbitrary EtherType with no authentication. Each such frame permanently consumes one buffer from the finite RX pool (CONFIGNETPKTRXCOUNT), so a brief broadcast flood exhausts the pool and the device can no longer receive traffic until it is rebooted — a persistent denial of service. There is no confidentiality or integrity impact.

The fix makes ethbridgehandlelocally() propagate the real netverdict and return NETCONTINUE for locally-kept frames, writing the bridge interface back through a new dstiface out-parameter so the packet follows the normal receive path and is unreferenced exactly once.

Database specific

{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/14xxx/CVE-2026-14696.json",
    "cna_assigner": "zephyr",
    "cwe_ids": [
        "CWE-401"
    ]
}

References

Affected packages

Git / github.com/zephyrproject-rtos/zephyr

Affected ranges

Type

GIT

Repo

https://github.com/zephyrproject-rtos/zephyr

Events

Introduced

684c9e8f32e4373a21098559f748f06915f950c9

Fixed

4eb007af465a1d28f2f35d93ecf139cc62c542a7

Database specific

Show details

{
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ],
    "extracted_events": [
        {
            "introduced": "4.4.0"
        },
        {
            "fixed": "4.4.2"
        }
    ]
}

Affected versions

v4.*

v4.4.0

Database specific

vanir_signatures

[
    {
        "signature_type": "Function",
        "deprecated": false,
        "digest": {
            "length": 411.0,
            "function_hash": "178243550905509610504895054849702584088"
        },
        "id": "CVE-2026-14696-2398e998",
        "target": {
            "function": "eth_bridge_handle_locally",
            "file": "subsys/net/l2/ethernet/bridge/bridge_input.c"
        },
        "source": "https://github.com/zephyrproject-rtos/zephyr/commit/4eb007af465a1d28f2f35d93ecf139cc62c542a7",
        "signature_version": "v1"
    },
    {
        "signature_type": "Line",
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "120705168840692625303709596167501560621",
                "140185408478339519338071855905329116161",
                "9746431515891233157849854345039344696",
                "160995344505454491493441912992312872135",
                "232506514414997224664252425653648937391",
                "12928447911990419443478352772744513454",
                "239984005106718783252474285997187592536",
                "150838593891777999993062708394229877306",
                "334251870856953052381130842430744049893",
                "24176519424457494054946473609223070914",
                "76269281695831461801643564025074679523",
                "145574817741007418636067603390053635850",
                "55610733974268756340903417646916543092",
                "315297764493019680029647061223872528043",
                "267868390585593816517915983992887850017",
                "167209391117043802373861165735576969686",
                "232819156379520175737864515261858228035",
                "335570984850408253564659187020765606790",
                "8947657881381843965299074544588608986",
                "253924529708140083978414822127303260140",
                "29797197291469060405039032388249614058",
                "128604930205786765057159669836897167183",
                "279180708747428306507722521790489871982",
                "155936180528092221718861027898634301033",
                "19077073952822478812143287529747825196",
                "306996179716146811599348534809884127191",
                "98880554240792600851013306236265956585",
                "67321139929719252608758556091569288689",
                "283854251222459935825005690768829735756",
                "137786945721016691984425942928765862513",
                "294689768735629251578024770859561994704",
                "133101769821518114074721841232573636075",
                "282206898586514708041032077451963584385",
                "197855240402713997451652241479683575037",
                "264618161365679694574901069709260734043",
                "272605217139939996643201430668477473451",
                "297637450950494277280011469594889923013",
                "146141099933766860904122205211002217652",
                "281293379721433549309423350633688012515",
                "97066965938480785035373634545746723128",
                "37692091291730728866327704872885664991",
                "148585253966116387231965889842019249903",
                "154633437174118878889250828137284470506",
                "146141099933766860904122205211002217652",
                "281293379721433549309423350633688012515",
                "41623091945917294993653861683624901356",
                "210609650841049278203033589441363030984",
                "164624034028634104020263577501267096656"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-14696-51bdbb6c",
        "target": {
            "file": "subsys/net/l2/ethernet/bridge/bridge_input.c"
        },
        "source": "https://github.com/zephyrproject-rtos/zephyr/commit/4eb007af465a1d28f2f35d93ecf139cc62c542a7",
        "signature_version": "v1"
    },
    {
        "signature_type": "Function",
        "deprecated": false,
        "digest": {
            "length": 923.0,
            "function_hash": "95425391598362615399653810308229241247"
        },
        "id": "CVE-2026-14696-86b2bf70",
        "target": {
            "function": "eth_bridge_input_process",
            "file": "subsys/net/l2/ethernet/bridge/bridge_input.c"
        },
        "source": "https://github.com/zephyrproject-rtos/zephyr/commit/4eb007af465a1d28f2f35d93ecf139cc62c542a7",
        "signature_version": "v1"
    },
    {
        "signature_type": "Function",
        "deprecated": false,
        "digest": {
            "length": 3185.0,
            "function_hash": "285432674285042314141847857336472088325"
        },
        "id": "CVE-2026-14696-8f3a8dd4",
        "target": {
            "function": "ethernet_recv",
            "file": "subsys/net/l2/ethernet/ethernet.c"
        },
        "source": "https://github.com/zephyrproject-rtos/zephyr/commit/4eb007af465a1d28f2f35d93ecf139cc62c542a7",
        "signature_version": "v1"
    },
    {
        "signature_type": "Line",
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "173725945873527262203524448773265986610",
                "30213875435359620761023939499429405979",
                "327665654562419863507282783884285592292",
                "162574352016518940079181892810075833979",
                "159758152616313202694445954628315453320",
                "324482256285756633220075532686289893854",
                "230033328511368044801048438664114391153",
                "330739361129644963312790093112510210539",
                "36683539276037562949669456179363058150",
                "183865488920191531244679165531190837067"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-14696-9a0800e0",
        "target": {
            "file": "subsys/net/l2/ethernet/ethernet.c"
        },
        "source": "https://github.com/zephyrproject-rtos/zephyr/commit/4eb007af465a1d28f2f35d93ecf139cc62c542a7",
        "signature_version": "v1"
    },
    {
        "signature_type": "Line",
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "141793912780291394533798469489614230515",
                "146155474272357091671892189504966504506",
                "169095876503668506077853258582684950597",
                "55654346696072770008197542414927695386"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-14696-d49d0315",
        "target": {
            "file": "include/zephyr/net/ethernet_bridge.h"
        },
        "source": "https://github.com/zephyrproject-rtos/zephyr/commit/4eb007af465a1d28f2f35d93ecf139cc62c542a7",
        "signature_version": "v1"
    }
]

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-14696.json"

vanir_signatures_modified

"2026-09-03T08:07:08Z"