CVE-2026-13351: Zephyr IPv6 Fragment Buffer Exhaustion Denial of Service

Technical summary

The vulnerability exists in Zephyr's IPv6 fragment-header processing code path. When a maliciously crafted fragmented IPv6 packet arrives, the packet buffer allocated from the RX memory slab is not properly released upon completion or error handling. This memory leak accumulates with each malicious packet processed. Because Zephyr devices typically operate with constrained memory and a finite pool of pre-allocated RX buffers (allocated from a memory slab), repeated exploitation quickly exhausts this pool. Once all buffer slots are consumed, the network interface cannot allocate new buffers for incoming packets, causing all subsequent receive operations to fail. The root cause is improper cleanup in the fragment-handling code path (CWE-772: Improper Resource Validation). Network reachability is restored only after device restart and buffer pool replenishment.

Business impact

Zephyr is widely deployed in IoT, embedded systems, and industrial control devices. A successful exploitation results in immediate and complete loss of network connectivity for the affected device. This can disrupt critical operations in manufacturing environments, smart infrastructure, medical devices, and connected consumer products. Unlike vulnerabilities requiring complex exploitation chains, this attack requires only network access and minimal resources—a few packets—making it a practical threat in real-world deployments. Organizations running Zephyr-based devices should prioritize assessment to identify exposed instances that could be rendered offline by remote attackers without authentication.

Affected systems

All versions of Zephyr project's Zephyr RTOS are affected by this vulnerability. The issue is specific to the IPv6 network stack implementation, so only devices running IPv6 are vulnerable. Devices that run IPv4-only or operate without network connectivity are not affected. Embedded systems, IoT gateways, industrial IoT nodes, and networked consumer devices using Zephyr are in scope. The Zephyr project has not yet added this CVE to the CISA Known Exploited Vulnerabilities (KEV) catalog, though the simplicity of the attack and high accessibility make public exploitation feasible.

Exploitability

This vulnerability has a CVSS 3.1 score of 7.5 (HIGH) with a vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, reflecting network-based access, low complexity, no privileges required, and high impact to availability. Exploitation does not require user interaction or special conditions (AC:L). The attacker needs only network-layer access to the target device and the ability to send IPv6 packets. No bypass of authentication or authorization is needed. The attack is reliable and repeatable—sending the same small set of crafted packets consistently produces the denial-of-service outcome. Organizations with Zephyr devices exposed to untrusted networks should assume high risk.

Remediation

Monitor the Zephyr project's official security advisories and release notes for patched versions that fix the buffer release issue in IPv6 fragment-header processing. Patches will address the improper resource cleanup by ensuring all allocated RX buffers are correctly returned to the memory slab pool, regardless of packet validity or processing outcome. Until patching is possible, network segmentation and access controls should be used to restrict which networks can reach Zephyr devices. Devices should be placed behind firewalls that filter untrusted IPv6 traffic or isolated to trusted network segments. Additionally, implement monitoring to detect abnormal reboot cycles or loss of connectivity that may indicate active exploitation.

Patch guidance

Contact Zephyr project maintainers and check the official Zephyr GitHub repository and security advisories for information on available patches and affected version ranges. Patches will likely be released as point updates or maintenance releases addressing the IPv6 fragment-handling code. After patches are available, conduct a phased roll-out in test environments to verify stability before deploying to production. Given the high severity and ease of exploitation, patching should be prioritized once verified fixes are released. Maintain an inventory of Zephyr versions across your IoT and embedded device fleet to streamline patch deployment.

Detection guidance

Monitor network-connected Zephyr devices for unexpected reboots, intermittent loss of network connectivity, or devices that stop responding to network requests without corresponding firewall or routing changes. On-device logging, if available, may show errors related to RX buffer exhaustion or network stack initialization failures. Network-layer detection is challenging because the attack uses standard IPv6 fragmentation headers; detection requires analysis of fragmented IPv6 packet patterns arriving in bursts from a single or small set of sources. Consider deploying network monitoring tools that can identify unusual fragmented IPv6 traffic targeting your Zephyr devices. If your devices support remote logging, configure verbose network stack logging to capture buffer allocation failures.

Why prioritize this

This CVE merits immediate prioritization due to its combination of high severity (7.5 CVSS), trivial exploitability, and lack of authentication requirements. Any Zephyr device with network exposure is at risk of being rendered offline by a remote attacker in seconds. The attack requires no sophisticated tools or knowledge, lowering the barrier to entry for threat actors. Organizations should treat exposed Zephyr devices as critical for immediate inventory, segmentation, and patch planning. While KEV status is not yet active, the technical characteristics suggest it may be added as the vulnerability becomes more widely known.

Risk score, explained

The CVSS 3.1 score of 7.5 reflects high impact to availability (complete loss of network service) combined with low attack complexity and no authentication barrier. The severity is not higher than 7.5 because confidentiality and integrity are not compromised—only availability is affected. However, the real-world risk to organizations may be higher than the numeric score suggests, given the practical ease of exploitation and the critical role network connectivity plays in IoT and embedded systems. Adjust internal risk prioritization upward if your devices operate in safety-critical or business-critical roles.

Frequently asked questions