A bitwise shift vulnerability in the Zephyr PTP subsystem allows a remote attacker to trigger undefined behavior by sending a crafted PTP_MSG_MANAGEMENT message that sets an unvalidated negative log_announce_interval value. When a later PTP_MSG_ANNOUNCE message is processed, the system calculates a timeout using a right‑shift operation that can exceed the 64‑bit integer width if the value is sufficiently negative, leading to a compiler‑generated illegal instruction trap on some architectures or an erroneous zero timeout that causes resource starvation loops.

The vulnerability affects the Zephyr Real‑Time Operating System. Any Zephyr build that includes the unvalidated log_announce_interval handling in the PTP subsystem is potentially impacted, with no specific version information provided in the advisory.

The flaw can be exploited remotely by sending a malicious PTP_MSG_MANAGEMENT packet to a Zephyr device participating in Precision Time Protocol. Attackers must have network access to the PTP management address space and must inject the payload before an announce message is processed. The CVSS score of 6.5 indicates moderate severity, and the EPSS score is less than 1%, suggesting a low likelihood of exploitation; the vulnerability is not listed in CISA KEV. If exploited, the attacker could cause the target system to crash or enter an infinite loop, resulting in a denial of service.