Zephyr's IPv6 network stack can be prevented from receiving or processing future packets when an attacker sends a small number of maliciously fragmented IPv6 packets. When such a packet is handled, the associated receive buffer is allocated from a memory slab but never released back to the pool. Repeating the malicious packet exhausts all receive buffers, halting the device’s ability to accept new traffic and resulting in a denial of service. This flaw is identified as a memory-management weakness, classified under CWE‑772.

Zephyr RTOS (Zephyr). Specific version information is not provided in the advisory.

The vulnerability carries a CVSS score of 7.5 and is not listed in CISA’s Known Exploited Vulnerabilities catalog. The exploit path requires the attacker to send carefully crafted fragmented IPv6 packets to a Zephyr-based device over the network. No special privileges or local access are needed; a remote attacker can trigger the denial of service. The effect is limited to network connectivity, causing the device to stop receiving traffic once all buffers are consumed.