Description
ethernet_recv() in subsys/net/l2/ethernet/ethernet.c validates only that the first net_buf of a received frame holds a plain 14-byte struct net_eth_hdr. When the ethertype is 0x8100 and VLAN is enabled on the interface, the same buffer is reinterpreted as the 18-byte struct net_eth_vlan_hdr without re-checking the length: the VLAN TCI and the inner ethertype are read from offsets 14..17, past pkt->buffer->len, and hdr_len is raised to 18 so the subsequent net_buf_pull() removes more bytes than the buffer holds.

A single unauthenticated frame of 14 to 17 bytes carrying the VLAN ethertype triggers this. No knowledge of the node's VLAN configuration is needed: net_eth_get_vlan_iface() returns the base interface for the priority tag 0, and a broadcast destination address satisfies the "frame is for me" test, so a 16-byte broadcast frame with ethertype 0x8100 and TCI 0x0000 reaches the pull. Nothing in the receive path enforces the 60-byte Ethernet minimum — the USB CDC ECM and CDC NCM gadget classes in particular hand host-supplied frames of any non-zero length straight to net_recv_data().

With assertions enabled, net_buf_simple_pull() asserts and the node panics. In a production build (assertions and CONFIG_NET_BUF_HARDENING off) the uint16_t buffer length underflows to 65534 and buf->data is advanced past the end of the fragment's storage, so every later parser reads far outside the buffer and any net_buf_add() on that fragment computes tailroom from the underflowed length. The result is a reliable remote denial of service and out-of-bounds access with information-disclosure and corruption potential.

Only configurations built with CONFIG_NET_VLAN=y that have a VLAN enabled on the receiving Ethernet interface, and whose MAC does not strip VLAN tags in hardware (ETHERNET_HW_VLAN_TAG_STRIP), are affected. The fix rejects the frame before the tag is read, so hdr_len is thereafter either 14 or 18 with both sizes validated against pkt->buffer->len.
Published: 2026-10-14
Score: 7.1 High
EPSS: n/a
KEV: No
Impact: Remote Denial of Service and Out‑of‑Bounds Read
Action: Patch
AI Analysis

Impact

The vulnerability is an out‑of‑bounds read and unsigned buffer length underflow in Zephyr’s Ethernet receive path. When a 14‑to‑17 byte frame contains the VLAN ethertype 0x8100 and VLAN support is enabled on the interface, the code interprets the VLAN header without re‑checking the packet length. This causes the VLAN tag fields to be read past the actual packet data, the frame length to be extended to 18 bytes, and a subsequent buffer pull removes more bytes than the buffer holds. In production build the length underflows to 65534, the buffer data pointer advances beyond the fragment storage, and later includes corrupt or out‑of‑bounds data in de‑serialization and when new data is added. The result is a reliable remote denial of service and potential memory disclosure or corruption.

Affected Systems

Zephyr Project Zephyr builds compiled with the Ethernet networking stack where VLAN support is enabled (CONFIG_NET_VLAN=y) and the interface does not strip VLAN tags in hardware. These include devices NCM classes to receive frames from a host and forward them to the Zephyr networking stack."

Risk and Exploitability

The flaw is scored as CVSS 7.1, indicating a high impact. EPSS is not available, and the vulnerability is not yet listed in the CISA KEV catalog. Attackers can trigger the flaw remotely from any traffic that reaches the Ethernet device, without authentication or special configuration, and can repeatedly send short VLAN frames to cause repeated crashes or data leakage. Because the exploit relies solely on the reception of a short VLAN frame, it can be performed from any network interface that the device exposes to traffic, making it a widespread threat to environments running affected Zephyr builds.

Generated by OpenCVE AI on October 15, 2026 at 00:47 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the Zephyr project patch that rejects truncated VLAN frames (e.g., the commit identified in the advisory).
  • If VLAN functionality is not required, disable CONFIG_NET_VLAN in the build or remove VLAN support from the Ethernet interface configuration.
  • If an immediate firmware update is not available, filter or block incoming VLAN frames with ethertype 0x8100 that are shorter than 18 bytes to prevent the underflow.

Generated by OpenCVE AI on October 15, 2026 at 00:47 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 14 Oct 2026 17:00:00 +0000

Type Values Removed Values Added
Description ethernet_recv() in subsys/net/l2/ethernet/ethernet.c validates only that the first net_buf of a received frame holds a plain 14-byte struct net_eth_hdr. When the ethertype is 0x8100 and VLAN is enabled on the interface, the same buffer is reinterpreted as the 18-byte struct net_eth_vlan_hdr without re-checking the length: the VLAN TCI and the inner ethertype are read from offsets 14..17, past pkt->buffer->len, and hdr_len is raised to 18 so the subsequent net_buf_pull() removes more bytes than the buffer holds. A single unauthenticated frame of 14 to 17 bytes carrying the VLAN ethertype triggers this. No knowledge of the node's VLAN configuration is needed: net_eth_get_vlan_iface() returns the base interface for the priority tag 0, and a broadcast destination address satisfies the "frame is for me" test, so a 16-byte broadcast frame with ethertype 0x8100 and TCI 0x0000 reaches the pull. Nothing in the receive path enforces the 60-byte Ethernet minimum — the USB CDC ECM and CDC NCM gadget classes in particular hand host-supplied frames of any non-zero length straight to net_recv_data(). With assertions enabled, net_buf_simple_pull() asserts and the node panics. In a production build (assertions and CONFIG_NET_BUF_HARDENING off) the uint16_t buffer length underflows to 65534 and buf->data is advanced past the end of the fragment's storage, so every later parser reads far outside the buffer and any net_buf_add() on that fragment computes tailroom from the underflowed length. The result is a reliable remote denial of service and out-of-bounds access with information-disclosure and corruption potential. Only configurations built with CONFIG_NET_VLAN=y that have a VLAN enabled on the receiving Ethernet interface, and whose MAC does not strip VLAN tags in hardware (ETHERNET_HW_VLAN_TAG_STRIP), are affected. The fix rejects the frame before the tag is read, so hdr_len is thereafter either 14 or 18 with both sizes validated against pkt->buffer->len.
Title Out-of-bounds read and net_buf length underflow in Zephyr Ethernet L2 when parsing a truncated VLAN header
Weaknesses CWE-125
References
Metrics cvssV3_1

{'score': 7.1, 'vector': 'CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: zephyr

Published:

Updated: 2026-10-14T16:45:57.967Z

Reserved: 2026-08-12T21:27:43.897Z

Link: CVE-2026-19673

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-14T17:18:26.800

Modified: 2026-10-14T17:18:26.800

Link: CVE-2026-19673

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-15T01:00:05Z

Weaknesses