CVE-2026-75083

MediumCVSS 5.9

Published: 14/10/2026(UTC)Updated: 16/10/2026(UTC)Translated: 14/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.23%

13th percentile - higher than 13% of all known CVEs

Summary

The NXP KW41Z IEEE 802.15.4 driver (kw41z_rx() in drivers/ieee802154/ieee802154_kw41z.c) computed the payload size as pkt_len = len - KW41Z_FCS_LENGTH in a uint8_t. Because the frame length comes from the unauthenticated RX_FRAME_LENGTH field of the ZLL IRQSTS register and only zero was rejected, a reported length of one underflowed to pkt_len == 255. This caused 255 bytes to be written into a 128-byte net_buf data block, overrunning it by up to 127 bytes into adjacent network-buffer-pool memory and reading past the PKT_BUFFER_RX register array.

Risk Assessment

An attacker within 802.15.4 radio range can flood frames with a length byte of one, triggering memory corruption in the shared receive buffer pool from interrupt context. The most plausible impact is a crash or corruption of other packets' data; the overflowing bytes are radio register contents rather than attacker-authored data, which bounds the integrity impact.

Recommendation

Update to a version containing the fix that rejects any length below KW41Z_FCS_LENGTH and additionally verifies net_buf_tailroom() of the first fragment before the copy loops (this also covers the CONFIG_NET_L2_OPENTHREAD variant). Until patched, consider limiting exposure of devices using this driver to untrusted 802.15.4 radio traffic.

Related vulnerabilities

Original NVD description (English source)

The receive path of the NXP KW41Z IEEE 802.15.4 driver, kw41z_rx() in drivers/ieee802154/ieee802154_kw41z.c, computed the payload size as pkt_len = len - KW41Z_FCS_LENGTH in a uint8_t, where len is the frame length reported by the radio. The interrupt handler kw41z_isr() obtained that length from the RX_FRAME_LENGTH field of the ZLL IRQSTS register — a copy of the PHY header length byte of the frame received over the air — and only rejected the value zero. A reported length of one therefore underflowed to pkt_len == 255. Because the packet is allocated with NET_AF_UNSPEC on a non-Ethernet L2, net_pkt_rx_alloc_with_buffer() does not clamp the request to the interface MTU; with the default fixed-size buffer pool (CONFIG_NET_BUF_FIXED_DATA_SIZE, CONFIG_NET_BUF_DATA_SIZE=128) the allocation succeeded as a chain of two fragments. The subsequent register-to-buffer copy loops write into the first fragment only, so 255 bytes were written into a 128-byte net_buf data block, overrunning it by up to 127 bytes into adjacent network-buffer-pool memory, and reading up to 128 bytes past the end of the radio's PKT_BUFFER_RX register array. The length field originates from an unauthenticated frame transmitted by any device within 802.15.4 radio range, and is captured by the hardware at PHY-header time — before frame filtering has completed — while the handler samples it after clearing the interrupt status, so an attacker flooding frames with a length byte of one can drive the underflow. The impact is memory corruption in the shared receive buffer pool from interrupt context, most plausibly a crash or corruption of other packets' data; the overflowing bytes are radio register contents rather than attacker-authored data, which bounds the integrity impact. The fix rejects any length below KW41Z_FCS_LENGTH and additionally verifies net_buf_tailroom() of the first fragment before the copy loops, which also covers the CONFIG_NET_L2_OPENTHREAD variant of the size computation.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS