CVE-2026-13351: net: Maliciously fragmented IPv6 packets can prevent receiving/processing future incoming packets
Zephyr's IPv6 network stack can be prevented from receiving or processing future incoming packets by sending a small number of maliciously fragmented IPv6 packets. When such a packet is handled by the fragment-header processing path, the associated RX network packet buffer (allocated from a memory slab) is not released back to the pool. Repeating the malicious packet exhausts all RX buffer slots, after which the device can no longer obtain RX buffers and stops receiving traffic, resulting in a denial of service.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Mitigate the denial of service by blocking or filtering maliciously fragmented IPv6 packets before they reach Zephyr's IPv6 network stack (e.g., using network ACLs/firewall/WAF/packet filtering rules that drop fragmented IPv6 traffic).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-13351?
CVE-2026-13351 has a severity rating of high at 7.5.
How do I fix CVE-2026-13351?
To mitigate CVE-2026-13351, ensure that you update Zephyr to the latest patched version provided by the Zephyr project.
What systems are affected by CVE-2026-13351?
CVE-2026-13351 affects systems utilizing the Zephyr operating system with IPv6 networking capabilities.
What is the risk associated with CVE-2026-13351?
CVE-2026-13351 poses a risk score of 43, indicating significant potential impact on network packet processing.
What kind of attack does CVE-2026-13351 involve?
CVE-2026-13351 involves an attack using maliciously fragmented IPv6 packets that disrupt normal packet reception and processing.