{"schema":"threatline.record/2","record":{"id":"CVE-2026-75083","aliases":["GHSA-2pwx-gg6f-535f"],"summary":"Integer underflow of the radio-reported frame length causes an out-of-bounds write in the NXP KW41Z IEEE 802.15.4 driver","details":"The receive path of the NXP KW41Z IEEE 802.15.4 driver, kw41z_rx() in drivers/ieee802154/ieee802154_kw41z.c, computed the payload size as pkt_len = len - KW41Z_FCS_LENGTH in a uint8_t, where len is the frame length reported by the radio. The interrupt handler kw41z_isr() obtained that length from the RX_FRAME_LENGTH field of the ZLL IRQSTS register — a copy of the PHY header length byte of the frame received over the air — and only rejected the value zero. A reported length of one therefore underflowed to pkt_len == 255.\n\nBecause the packet is allocated with NET_AF_UNSPEC on a non-Ethernet L2, net_pkt_rx_alloc_with_buffer() does not clamp the request to the interface MTU; with the default fixed-size buffer pool (CONFIG_NET_BUF_FIXED_DATA_SIZE, CONFIG_NET_BUF_DATA_SIZE=128) the allocation succeeded as a chain of two fragments. The subsequent register-to-buffer copy loops write into the first fragment only, so 255 bytes were written into a 128-byte net_buf data block, overrunning it by up to 127 bytes into adjacent network-buffer-pool memory, and reading up to 128 bytes past the end of the radio's PKT_BUFFER_RX register array.\n\nThe length field originates from an unauthenticated frame transmitted by any device within 802.15.4 radio range, and is captured by the hardware at PHY-header time — before frame filtering has completed — while the handler samples it after clearing the interrupt status, so an attacker flooding frames with a length byte of one can drive the underflow. The impact is memory corruption in the shared receive buffer pool from interrupt context, most plausibly a crash or corruption of other packets' data; the overflowing bytes are radio register contents rather than attacker-authored data, which bounds the integrity impact.\n\nThe fix rejects any length below KW41Z_FCS_LENGTH and additionally verifies net_buf_tailroom() of the first fragment before the copy loops, which also covers the CONFIG_NET_L2_OPENTHREAD variant of the size computation.","categories":["Unclassified"],"product":"zephyr","vendor":"zephyrproject","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-75083","source_modified_at":"2026-10-16T15:31:46.531Z","fetched_at":"2026-10-23T18:48:36.087640Z","product":"zephyr","vendor":"zephyrproject","versions":[{"lessThan":"4.5.0","status":"affected","version":"1.8.0","versionType":"semver"}],"defaultStatus":"unaffected"},{"source":"GitHub Advisory Database","source_url":"https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-2pwx-gg6f-535f","source_modified_at":"2026-10-14T16:07:26Z","fetched_at":"2026-10-24T10:48:42.330819Z","package":{"ecosystem":"other","name":"zephyr"},"range":">= 1.8.0, <= 4.4.2"}],"fixed_versions":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-75083","source_modified_at":"2026-10-16T15:31:46.531Z","fetched_at":"2026-10-23T18:48:36.087640Z","package":{"name":"zephyr","ecosystem":null},"version":"4.5.0","basis":"first unaffected version stated in the CVE record"},{"source":"GitHub Advisory Database","source_url":"https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-2pwx-gg6f-535f","source_modified_at":"2026-10-14T16:07:26Z","fetched_at":"2026-10-24T10:48:42.330819Z","package":{"ecosystem":"other","name":"zephyr"},"version":"4.5.0"}],"cvss":5.9,"severity":"Medium","kev":{"listed":false},"epss":{"probability":0.00229,"percentile":0.12994,"score_date":"2026-10-23"},"published_at":"2026-10-14T16:45:56.541Z","modified_at":"2026-10-16T15:31:46.531Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-75083","fetched_at":"2026-10-23T18:48:36.087640Z","source_modified_at":"2026-10-16T15:31:46.531Z"},{"source":"GitHub Advisory Database","url":"https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-2pwx-gg6f-535f","fetched_at":"2026-10-24T10:48:42.330819Z","source_modified_at":"2026-10-14T16:07:26Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-75083","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CVE List","GitHub Advisory Database","EPSS"],"references":[{"source":"CVE List","url":"https://github.com/zephyrproject-rtos/zephyr/commit/51d71864578c08eb1a1201f87b46ec81c8609d62","tags":["patch"]},{"source":"CVE List","url":"https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-2pwx-gg6f-535f"}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","ssvc":{"exploitation":"none","automatable":"no","technical_impact":"partial","assessed_at":"2026-10-16T15:25:03.202886Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-16T15:31:46.531Z","content_hash":"8425b062bdf85bfc67731eb6b475941eee1080ed4ca170595b81815752807bc2"}}