Description
The CC1200 sub-GHz IEEE 802.15.4 driver takes the PHY packet length from the first byte of the radio's RX FIFO in get_packet_length() and validates it in verify_rxfifo_validity() (drivers/ieee802154/ieee802154_cc1200.c). That validation only enforced a lower bound (pkt_len < 3); its second clause rejects a FIFO that holds more bytes than declared and therefore never bounds large values. Because the driver configures the radio for variable packet length with PKT_LEN = 0xFF, the length byte is an over-the-air value of 0-255 that reached net_pkt_rx_alloc_with_buffer() and the subsequent SPI burst read unclamped.

An unauthenticated attacker within radio range can transmit a frame that presents a length byte above the IEEE 802.15.4 maximum of 127 while the chip's 128-byte RX FIFO has not overflowed, so the driver's RX_FIFO_ERROR pre-check does not fire. Reaching this state depends on RF framing and timing, since the RX thread is driven off the PKT_SYNC_RXTX signal and may sample the FIFO before a packet is complete; no pairing, authentication, or user interaction is required.

With the default CONFIG_NET_BUF_FIXED_DATA_SIZE and CONFIG_NET_BUF_DATA_SIZE=128, an allocation larger than one fragment is satisfied by a chain of fragments, but read_rxfifo_content() performs a single SPI burst of pkt_len bytes into the first fragment's buf->data and then calls net_buf_add() with the same length. A length above 128 therefore writes up to 127 bytes past the end of a fragment in the contiguous rx_bufs pool and leaves a net_buf whose len exceeds its capacity. The overflowing bytes are FIFO-underflow output rather than attacker-chosen data, so the practical impact is network-buffer-pool corruption and crashes rather than a controlled write. Only builds that enable CONFIG_IEEE802154_CC1200 with an attached CC1200 radio are affected.
Published: 2026-10-14
Score: 6.8 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Out-of-bounds write causing network buffer corruption and crashes
Action: Patch immediately
AI Analysis

Impact

The TI CC1200 IEEE 802.15.4 driver in Zephyr does not properly validate the length byte received from the radio’s FIFO. It only checks that the value is at least 3, but it fails to enforce the IEEE 802.15.4 maximum of 127. A malicious device can transmit a frame with an inflated length byte, triggering the driver to allocate a buffer that is too small and then write past the buffer’s bounds when the SPI burst read is performed. The overflow writes only FIFO‑underflow data, so it does not allow an attacker to inject arbitrary payloads; however, it corrupts the contiguous rx_bufs pool and can lead to application crashes.

Affected Systems

All Zephyr builds that enable CONFIG_IEEE802154_CC1200 and are paired with a TI CC1200 radio are vulnerable. The problem is tied to the use of variable packet length with PKT_LEN set to 0xFF and to the default configuration of net_buf sizes (CONFIG_NET_BUF_FIXED_DATA_SIZE and CONFIG_NET_BUF_DATA_SIZE set to 128). Any system that uses these settings and has the CC1200 driver active is at risk.

Risk and Exploitability

The CVSS score is 6.8, indicating moderate severity, and the EPSS score of less than 1% suggests a low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. An attacker only needs to be within radio range and transmit a malformed packet; no pairing or authentication is required. Because the overflow corrupts internal buffer structures rather than executing arbitrary code, the practical impact is limited to service disruption through crashes rather than a denial of the entire system.

Generated by OpenCVE AI on October 15, 2026 at 16:14 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update your Zephyr firmware to the latest release that includes commit 26a8b8294bf28523c7aa2f15cf728517980ee593, which corrects the packet‑length validation.
  • If a firmware update is not immediately possible, remove or disable CONFIG_IEEE802154_CC1200 from your defconfig and rebuild the system so the driver is not loaded.
  • As a temporary measure, protect the device from radio exposure by shielding it or ensuring that no CC1200 transmitter can reach it during operation.

Generated by OpenCVE AI on October 15, 2026 at 16:14 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 05 Nov 2026 12:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Sun, 18 Oct 2026 04:45:00 +0000

Type Values Removed Values Added
First Time appeared Zephyrproject
Zephyrproject zephyr
Vendors & Products Zephyrproject
Zephyrproject zephyr

Wed, 14 Oct 2026 17:00:00 +0000

Type Values Removed Values Added
Description The CC1200 sub-GHz IEEE 802.15.4 driver takes the PHY packet length from the first byte of the radio's RX FIFO in get_packet_length() and validates it in verify_rxfifo_validity() (drivers/ieee802154/ieee802154_cc1200.c). That validation only enforced a lower bound (pkt_len < 3); its second clause rejects a FIFO that holds more bytes than declared and therefore never bounds large values. Because the driver configures the radio for variable packet length with PKT_LEN = 0xFF, the length byte is an over-the-air value of 0-255 that reached net_pkt_rx_alloc_with_buffer() and the subsequent SPI burst read unclamped. An unauthenticated attacker within radio range can transmit a frame that presents a length byte above the IEEE 802.15.4 maximum of 127 while the chip's 128-byte RX FIFO has not overflowed, so the driver's RX_FIFO_ERROR pre-check does not fire. Reaching this state depends on RF framing and timing, since the RX thread is driven off the PKT_SYNC_RXTX signal and may sample the FIFO before a packet is complete; no pairing, authentication, or user interaction is required. With the default CONFIG_NET_BUF_FIXED_DATA_SIZE and CONFIG_NET_BUF_DATA_SIZE=128, an allocation larger than one fragment is satisfied by a chain of fragments, but read_rxfifo_content() performs a single SPI burst of pkt_len bytes into the first fragment's buf->data and then calls net_buf_add() with the same length. A length above 128 therefore writes up to 127 bytes past the end of a fragment in the contiguous rx_bufs pool and leaves a net_buf whose len exceeds its capacity. The overflowing bytes are FIFO-underflow output rather than attacker-chosen data, so the practical impact is network-buffer-pool corruption and crashes rather than a controlled write. Only builds that enable CONFIG_IEEE802154_CC1200 with an attached CC1200 radio are affected.
Title Out-of-bounds write in the TI CC1200 IEEE 802.15.4 driver from an unvalidated radio-supplied packet length
Weaknesses CWE-787
References
Metrics cvssV3_1

{'score': 6.8, 'vector': 'CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H'}

Subscriptions

Zephyrproject Zephyr
cve-icon MITRE

Status: PUBLISHED

Assigner: zephyr

Published:

Updated: 2026-11-04T05:01:06.611Z

Reserved: 2026-08-17T16:17:47.262Z

Link: CVE-2026-75084

cve-icon Vulnrichment

Updated: 2026-10-16T15:28:31.391Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-14T17:19:10.457

Modified: 2026-11-04T05:19:00.677

Link: CVE-2026-75084

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-18T04:30:13Z

Weaknesses