The vulnerability lies in the IPv6 Neighbor Solicitation handling where a transmit packet is leaked when an unresolved neighbor has a pending queue. The leak causes a permanent drain of the transmit buffer pool, effectively blocking all outgoing traffic including TCP/UDP, ARP, and ND responses. The impact is a persistent network denial of service that does not recover until the system reboots. This weakness corresponds to missing resource release (CWE‑401).

This issue affects systems running the Zephyr RTOS, specifically the network subsystem in zephyr:zephyr. The affected component is the IPv6 neighbor solicitation logic in subsys/net/ip/ipv6_nbr.c, which is part of the Zephyr networking stack. No specific hardware or configuration versions are listed beyond the default Zephyr configuration, though systems with the default CONFIG_NET_PKT_TX_COUNT of 4 (or 14 on Ethernet) are at risk.

The vulnerability has a CVSS score of 6.5 and is not listed in the CISA KEV catalog. The EPSS score is not available, indicating insufficient data on exploit probability. The exploit can be triggered deterministically by a local or on‑link attacker who sends a burst of packets that all spoof the same nonexistent on‑link source address. When the neighbor resolution process is invoked for each packet, the governed branch permanently leaks transmit buffers, draining the pool within a short burst. Because the condition is tied to the neighbor resolution timer and network traffic, an attacker can repeatedly exercise the code path in a short timeframe. The resulting denial lasts for the lifetime of the device until a reboot occurs, unless mitigated by configuration changes or firmware updates. The absence of self‑healing means the risk is ongoing until remediation is applied.