Description
The STM32WBA IEEE 802.15.4 driver in drivers/ieee802154/ieee802154_stm32wba.c computed the packet length of a received frame as pkt_len = rx_frame->length - IEEE802154_FCS_LENGTH without first checking that the radio-reported length could hold an FCS. pkt_len is a uint8_t, so a reported length of 0 or 1 wrapped to 254 or 255. The only bound on the resulting value was __ASSERT_NO_MSG(pkt_len <= CONFIG_NET_BUF_DATA_SIZE), which compiles to nothing in the default production configuration (CONFIG_ASSERT=n).

The length originates in the ST link-layer receive-done metadata (p_metadata->length, stored by stm32wba_802154_receive_done()), and ultimately in the PHY header of a frame received over the air, so it is influenced by any attacker within radio range of the device. Reaching the underflow requires the vendor link layer to surface a frame shorter than the FCS with no error; the driver performed no validation of its own on that value.

When the underflow occurs, stm32wba_802154_rx_thread() calls net_pkt_write(pkt, rx_frame->psdu, pkt_len) with a length of about 254 bytes against a receive buffer that holds at most one PHY packet (IEEE802154_MAX_PHY_PACKET_SIZE, 127 bytes). This reads roughly 128 bytes past the end of the radio receive buffer and copies that adjacent memory into a network packet that is submitted to the networking stack, giving an out-of-bounds read with a potential disclosure of adjacent RAM plus needless oversized packet allocation in the RX thread.

The fix rejects a frame whose reported length is smaller than IEEE802154_FCS_LENGTH before the subtraction, and replaces the compiled-out assertion with a runtime length check that drops oversized frames — matching the runtime check already present in drivers/ieee802154/ieee802154_nrf5.c.
Published: 2026-10-14
Score: 4.2 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Out-of-bounds read leading to potential memory disclosure
Action: Immediate Patch
AI Analysis

Impact

The STM32WBA IEEE 802.15.4 driver in Zephyr’s networking layer fails to guard against a frame‑length underflow when calculating the packet length from the radio report. If a malicious source on the air side sends a frame whose reported length is 0 or 1, the 8‑bit subtraction wrapped to 254 or 255. That oversized length is then used to read from the radio receive buffer and write into a network packet, pulling roughly 128 bytes past the end of the buffer into the OS memory. The resulting out‑of‑bounds read can expose adjacent RAM contents to the attacker while also allocating an unnecessarily large network packet. The weakness is an example of CWE‑125: Out‑of‑Bounds Read.

Affected Systems

Zephyr RTOS builds that include the STM32WBA IEEE 802.15.4 driver in drivers/ieee802154/ieee802154_stm32wba.c are affected. Any Zephyr release that compiled the driver before the commit that added the length check is vulnerable. Devices using the unpatched driver and running without runtime assertions enabled are at risk.

Risk and Exploitability

The CVSS score of 4.2 denotes moderate severity, the EPSS score is less than 1 % and the vulnerability is not listed in CISA’s KEV catalog. An attacker must be within radio range of the device and able to transmit a crafted IEEE 802.15.4 packet with a length that underflows. The exploit does not provide code execution, but it can leak memory contents and cause inefficient packet allocation, thus primarily raising confidentiality risk while leaving integrity and availability largely intact.

Generated by OpenCVE AI on October 15, 2026 at 16:13 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Zephyr to a release that contains the patched STM32WBA IEEE 802.15.4 driver code, which checks frame length before allowing the subtraction.
  • Enable runtime assertions (CONFIG_ASSERT=y) in the build configuration to detect and stop improper packet lengths during development and testing.
  • If an immediate upgrade is not feasible, modify the application’s networking filter to drop any frame whose reported length is smaller than IEEE802154_FCS_LENGTH before the driver processes it.

Generated by OpenCVE AI on October 15, 2026 at 16:13 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sun, 18 Oct 2026 04:45:00 +0000

Type Values Removed Values Added
First Time appeared Zephyrproject
Zephyrproject zephyr
Vendors & Products Zephyrproject
Zephyrproject zephyr

Sat, 17 Oct 2026 13:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 14 Oct 2026 17:00:00 +0000

Type Values Removed Values Added
Description The STM32WBA IEEE 802.15.4 driver in drivers/ieee802154/ieee802154_stm32wba.c computed the packet length of a received frame as pkt_len = rx_frame->length - IEEE802154_FCS_LENGTH without first checking that the radio-reported length could hold an FCS. pkt_len is a uint8_t, so a reported length of 0 or 1 wrapped to 254 or 255. The only bound on the resulting value was __ASSERT_NO_MSG(pkt_len <= CONFIG_NET_BUF_DATA_SIZE), which compiles to nothing in the default production configuration (CONFIG_ASSERT=n). The length originates in the ST link-layer receive-done metadata (p_metadata->length, stored by stm32wba_802154_receive_done()), and ultimately in the PHY header of a frame received over the air, so it is influenced by any attacker within radio range of the device. Reaching the underflow requires the vendor link layer to surface a frame shorter than the FCS with no error; the driver performed no validation of its own on that value. When the underflow occurs, stm32wba_802154_rx_thread() calls net_pkt_write(pkt, rx_frame->psdu, pkt_len) with a length of about 254 bytes against a receive buffer that holds at most one PHY packet (IEEE802154_MAX_PHY_PACKET_SIZE, 127 bytes). This reads roughly 128 bytes past the end of the radio receive buffer and copies that adjacent memory into a network packet that is submitted to the networking stack, giving an out-of-bounds read with a potential disclosure of adjacent RAM plus needless oversized packet allocation in the RX thread. The fix rejects a frame whose reported length is smaller than IEEE802154_FCS_LENGTH before the subtraction, and replaces the compiled-out assertion with a runtime length check that drops oversized frames — matching the runtime check already present in drivers/ieee802154/ieee802154_nrf5.c.
Title Out-of-bounds read from received-frame length underflow in the STM32WBA IEEE 802.15.4 driver
Weaknesses CWE-125
References
Metrics cvssV3_1

{'score': 4.2, 'vector': 'CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L'}

Subscriptions

Zephyrproject Zephyr
cve-icon MITRE

Status: PUBLISHED

Assigner: zephyr

Published:

Updated: 2026-11-04T05:01:08.079Z

Reserved: 2026-08-17T16:17:49.267Z

Link: CVE-2026-75085

cve-icon Vulnrichment

Updated: 2026-10-16T15:28:28.937Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-14T17:19:10.607

Modified: 2026-11-04T05:19:00.830

Link: CVE-2026-75085

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-18T04:30:13Z

Weaknesses