Issuing an ICMP ping to a device’s own IPv4 address via the `net ping` shell command causes the network stack to recursively re‑enter the input path on the same work‑queue stack. The uncontrolled recursion leads to a stack overflow that can corrupt the kernel stack, causing the system to crash and become unavailable – a denial of service. The flaw is classified as CWE‑674.

The vulnerability is found in the Zephyr project RTOS networking stack. No specific product or version information is provided, so any current Zephyr release lacking the patch may be affected.

The CVSS score of 6.1 indicates moderate risk. The EPSS score is not available, and the flaw is not listed in the CISA KEV catalog. The attack vector is inferred to be local, requiring the attacker to have shell access to run `net ping`. Because the overflow only occurs when pinging the device’s own address, remote exploitation is unlikely without such access. The primary consequence is a kernel crash that would deny service to the device.