Description
The receive path of the NXP KW41Z IEEE 802.15.4 driver, kw41z_rx() in drivers/ieee802154/ieee802154_kw41z.c, computed the payload size as pkt_len = len - KW41Z_FCS_LENGTH in a uint8_t, where len is the frame length reported by the radio. The interrupt handler kw41z_isr() obtained that length from the RX_FRAME_LENGTH field of the ZLL IRQSTS register — a copy of the PHY header length byte of the frame received over the air — and only rejected the value zero. A reported length of one therefore underflowed to pkt_len == 255.

Because the packet is allocated with NET_AF_UNSPEC on a non-Ethernet L2, net_pkt_rx_alloc_with_buffer() does not clamp the request to the interface MTU; with the default fixed-size buffer pool (CONFIG_NET_BUF_FIXED_DATA_SIZE, CONFIG_NET_BUF_DATA_SIZE=128) the allocation succeeded as a chain of two fragments. The subsequent register-to-buffer copy loops write into the first fragment only, so 255 bytes were written into a 128-byte net_buf data block, overrunning it by up to 127 bytes into adjacent network-buffer-pool memory, and reading up to 128 bytes past the end of the radio's PKT_BUFFER_RX register array.

The length field originates from an unauthenticated frame transmitted by any device within 802.15.4 radio range, and is captured by the hardware at PHY-header time — before frame filtering has completed — while the handler samples it after clearing the interrupt status, so an attacker flooding frames with a length byte of one can drive the underflow. The impact is memory corruption in the shared receive buffer pool from interrupt context, most plausibly a crash or corruption of other packets' data; the overflowing bytes are radio register contents rather than attacker-authored data, which bounds the integrity impact.

The fix rejects any length below KW41Z_FCS_LENGTH and additionally verifies net_buf_tailroom() of the first fragment before the copy loops, which also covers the CONFIG_NET_L2_OPENTHREAD variant of the size computation.
Published: 2026-10-14
Score: 5.9 Medium
EPSS: n/a
KEV: No
Impact: Memory corruption via out‑of‑bounds write
Action: Apply Patch
AI Analysis

Impact

The KW41Z IEEE 802.15.4 driver contains an integer underflow that causes the received frame length to be computed incorrectly as 255 when a frame length byte of one is received, leading to a 255‑byte copy into a 128‑byte buffer and corrupting the shared network buffer pool. This flaw is an example of CWE‑191, an integer underflow weakness. The overflowing data originates from radio registers and is not attacker‑controlled, so the integrity impact is limited to data corruption rather than arbitrary data injection.

Affected Systems

Zephyr Project’s NXP KW41Z IEEE 802.15.4 driver, present in any Zephyr build that includes the kw41z driver. No specific Zephyr release version is listed, but the vulnerability is fixed in the commit referenced in the advisory.

Risk and Exploitability

The attack vector is physical radio; an attacker can send a crafted frame over the 802.15.4 link from any device within range. Because the radio reports the length before authentication or filtering, the attacker can trigger the underflow from normal interrupt context. The CVSS score of 5.9 places the issue in the medium range, the EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog. The exploit requires only the ability to transmit frames over the air, no special privileges, and can cause denial of service or corruption of packet data.

Generated by OpenCVE AI on October 15, 2026 at 00:15 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the latest Zephyr update that includes commit 51d7186 or later, which checks and rejects frame lengths smaller than the FCS size, mitigating the integer underflow (CWE‑191).
  • If a patch cannot be applied immediately, remove or disable the KW41Z IEEE 802.15.4 driver or disable the corresponding network interface in your Zephyr build.
  • As an additional precaution, verify that no other device in radio range can repeatedly send frames with a small length byte; consider network segmentation or radio frequency isolation.

Generated by OpenCVE AI on October 15, 2026 at 00:15 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 14 Oct 2026 17:00:00 +0000

Type Values Removed Values Added
Description The receive path of the NXP KW41Z IEEE 802.15.4 driver, kw41z_rx() in drivers/ieee802154/ieee802154_kw41z.c, computed the payload size as pkt_len = len - KW41Z_FCS_LENGTH in a uint8_t, where len is the frame length reported by the radio. The interrupt handler kw41z_isr() obtained that length from the RX_FRAME_LENGTH field of the ZLL IRQSTS register — a copy of the PHY header length byte of the frame received over the air — and only rejected the value zero. A reported length of one therefore underflowed to pkt_len == 255. Because the packet is allocated with NET_AF_UNSPEC on a non-Ethernet L2, net_pkt_rx_alloc_with_buffer() does not clamp the request to the interface MTU; with the default fixed-size buffer pool (CONFIG_NET_BUF_FIXED_DATA_SIZE, CONFIG_NET_BUF_DATA_SIZE=128) the allocation succeeded as a chain of two fragments. The subsequent register-to-buffer copy loops write into the first fragment only, so 255 bytes were written into a 128-byte net_buf data block, overrunning it by up to 127 bytes into adjacent network-buffer-pool memory, and reading up to 128 bytes past the end of the radio's PKT_BUFFER_RX register array. The length field originates from an unauthenticated frame transmitted by any device within 802.15.4 radio range, and is captured by the hardware at PHY-header time — before frame filtering has completed — while the handler samples it after clearing the interrupt status, so an attacker flooding frames with a length byte of one can drive the underflow. The impact is memory corruption in the shared receive buffer pool from interrupt context, most plausibly a crash or corruption of other packets' data; the overflowing bytes are radio register contents rather than attacker-authored data, which bounds the integrity impact. The fix rejects any length below KW41Z_FCS_LENGTH and additionally verifies net_buf_tailroom() of the first fragment before the copy loops, which also covers the CONFIG_NET_L2_OPENTHREAD variant of the size computation.
Title Integer underflow of the radio-reported frame length causes an out-of-bounds write in the NXP KW41Z IEEE 802.15.4 driver
Weaknesses CWE-191
References
Metrics cvssV3_1

{'score': 5.9, 'vector': 'CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: zephyr

Published:

Updated: 2026-10-14T16:45:56.541Z

Reserved: 2026-08-17T16:17:45.295Z

Link: CVE-2026-75083

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-14T17:19:10.307

Modified: 2026-10-14T17:19:10.307

Link: CVE-2026-75083

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-15T00:30:07Z

Weaknesses
  • CWE-191

    Integer Underflow (Wrap or Wraparound)