{"id":"CVE-2026-14696","summary":"Ethernet bridge RX packet leak enables denial of service via RX buffer-pool exhaustion","details":"When Ethernet bridging is enabled (CONFIG_NET_ETHERNET_BRIDGE), eth_bridge_input_process() in subsys/net/l2/ethernet/bridge/bridge_input.c decides how each frame received on a bridge member interface is handled. For frames that must also be delivered to the local stack, the code called eth_bridge_handle_locally() and returned NET_OK. That helper does not consume the packet — it only calls bridge_iface_recv() (via virtual_recv()), which returns NET_CONTINUE without taking ownership of pkt.\n\nThe NET_OK verdict then propagates through ethernet_recv() up to processing_data() in subsys/net/ip/net_core.c, where NET_OK is interpreted as \"the packet was consumed, do not free it.\" Because no consumer actually took ownership, the RX net_pkt is never returned to the pool and is leaked. The concretely reproducible leak occurs for frames whose EtherType has no registered L3 handler when CONFIG_NET_ETHERNET_FORWARD_UNRECOGNISED_ETHERTYPE is set (default y when CONFIG_NET_SOCKETS_PACKET is enabled): the fall-through L3 dispatch does not overwrite the NET_OK verdict, so ethernet_recv() returns NET_OK and the buffer is never released.\n\nAny device on a bridged L2 segment can emit broadcast/multicast frames carrying an arbitrary EtherType with no authentication. Each such frame permanently consumes one buffer from the finite RX pool (CONFIG_NET_PKT_RX_COUNT), so a brief broadcast flood exhausts the pool and the device can no longer receive traffic until it is rebooted — a persistent denial of service. There is no confidentiality or integrity impact.\n\nThe fix makes eth_bridge_handle_locally() propagate the real net_verdict and return NET_CONTINUE for locally-kept frames, writing the bridge interface back through a new dst_iface out-parameter so the packet follows the normal receive path and is unreferenced exactly once.","aliases":["GHSA-3m4w-wc4v-766q"],"modified":"2026-09-03T08:07:08.285422Z","published":"2026-08-31T18:57:06.627Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/14xxx/CVE-2026-14696.json","cna_assigner":"zephyr","cwe_ids":["CWE-401"]},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/14xxx/CVE-2026-14696.json"},{"type":"ADVISORY","url":"https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-3m4w-wc4v-766q"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-14696"},{"type":"FIX","url":"https://github.com/zephyrproject-rtos/zephyr/commit/4eb007af465a1d28f2f35d93ecf139cc62c542a7"},{"type":"PACKAGE","url":"https://github.com/zephyrproject-rtos/zephyr"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/zephyrproject-rtos/zephyr","events":[{"introduced":"684c9e8f32e4373a21098559f748f06915f950c9"},{"fixed":"4eb007af465a1d28f2f35d93ecf139cc62c542a7"}],"database_specific":{"extracted_events":[{"introduced":"4.4.0"},{"fixed":"4.4.2"}],"source":["AFFECTED_FIELD","REFERENCES"]}}],"versions":["v4.4.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-14696.json","vanir_signatures_modified":"2026-09-03T08:07:08Z","vanir_signatures":[{"source":"https://github.com/zephyrproject-rtos/zephyr/commit/4eb007af465a1d28f2f35d93ecf139cc62c542a7","target":{"file":"subsys/net/l2/ethernet/bridge/bridge_input.c","function":"eth_bridge_handle_locally"},"deprecated":false,"digest":{"function_hash":"178243550905509610504895054849702584088","length":411},"id":"CVE-2026-14696-2398e998","signature_type":"Function","signature_version":"v1"},{"digest":{"line_hashes":["120705168840692625303709596167501560621","140185408478339519338071855905329116161","9746431515891233157849854345039344696","160995344505454491493441912992312872135","232506514414997224664252425653648937391","12928447911990419443478352772744513454","239984005106718783252474285997187592536","150838593891777999993062708394229877306","334251870856953052381130842430744049893","24176519424457494054946473609223070914","76269281695831461801643564025074679523","145574817741007418636067603390053635850","55610733974268756340903417646916543092","315297764493019680029647061223872528043","267868390585593816517915983992887850017","167209391117043802373861165735576969686","232819156379520175737864515261858228035","335570984850408253564659187020765606790","8947657881381843965299074544588608986","253924529708140083978414822127303260140","29797197291469060405039032388249614058","128604930205786765057159669836897167183","279180708747428306507722521790489871982","155936180528092221718861027898634301033","19077073952822478812143287529747825196","306996179716146811599348534809884127191","98880554240792600851013306236265956585","67321139929719252608758556091569288689","283854251222459935825005690768829735756","137786945721016691984425942928765862513","294689768735629251578024770859561994704","133101769821518114074721841232573636075","282206898586514708041032077451963584385","197855240402713997451652241479683575037","264618161365679694574901069709260734043","272605217139939996643201430668477473451","297637450950494277280011469594889923013","146141099933766860904122205211002217652","281293379721433549309423350633688012515","97066965938480785035373634545746723128","37692091291730728866327704872885664991","148585253966116387231965889842019249903","154633437174118878889250828137284470506","146141099933766860904122205211002217652","281293379721433549309423350633688012515","41623091945917294993653861683624901356","210609650841049278203033589441363030984","164624034028634104020263577501267096656"],"threshold":0.9},"id":"CVE-2026-14696-51bdbb6c","signature_type":"Line","signature_version":"v1","source":"https://github.com/zephyrproject-rtos/zephyr/commit/4eb007af465a1d28f2f35d93ecf139cc62c542a7","target":{"file":"subsys/net/l2/ethernet/bridge/bridge_input.c"},"deprecated":false},{"deprecated":false,"digest":{"function_hash":"95425391598362615399653810308229241247","length":923},"id":"CVE-2026-14696-86b2bf70","signature_type":"Function","signature_version":"v1","source":"https://github.com/zephyrproject-rtos/zephyr/commit/4eb007af465a1d28f2f35d93ecf139cc62c542a7","target":{"file":"subsys/net/l2/ethernet/bridge/bridge_input.c","function":"eth_bridge_input_process"}},{"target":{"function":"ethernet_recv","file":"subsys/net/l2/ethernet/ethernet.c"},"deprecated":false,"digest":{"function_hash":"285432674285042314141847857336472088325","length":3185},"id":"CVE-2026-14696-8f3a8dd4","signature_type":"Function","signature_version":"v1","source":"https://github.com/zephyrproject-rtos/zephyr/commit/4eb007af465a1d28f2f35d93ecf139cc62c542a7"},{"deprecated":false,"digest":{"line_hashes":["173725945873527262203524448773265986610","30213875435359620761023939499429405979","327665654562419863507282783884285592292","162574352016518940079181892810075833979","159758152616313202694445954628315453320","324482256285756633220075532686289893854","230033328511368044801048438664114391153","330739361129644963312790093112510210539","36683539276037562949669456179363058150","183865488920191531244679165531190837067"],"threshold":0.9},"id":"CVE-2026-14696-9a0800e0","signature_type":"Line","signature_version":"v1","source":"https://github.com/zephyrproject-rtos/zephyr/commit/4eb007af465a1d28f2f35d93ecf139cc62c542a7","target":{"file":"subsys/net/l2/ethernet/ethernet.c"}},{"signature_version":"v1","source":"https://github.com/zephyrproject-rtos/zephyr/commit/4eb007af465a1d28f2f35d93ecf139cc62c542a7","target":{"file":"include/zephyr/net/ethernet_bridge.h"},"deprecated":false,"digest":{"line_hashes":["141793912780291394533798469489614230515","146155474272357091671892189504966504506","169095876503668506077853258582684950597","55654346696072770008197542414927695386"],"threshold":0.9},"id":"CVE-2026-14696-d49d0315","signature_type":"Line"}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}]}