The vulnerability exists in the get_ihpc_inlined_size() function within Zephyr's 6LoWPAN IP Header Compression uncompression code (subsys/net/ip/6lo.c). The function uses an index derived from bits in the received IPHC dispatch word to access da_inline_size_table, which has 13 entries. However, the index can be a 4-bit value ranging from 0 to 15, and the reserved values 13, 14, and 15 are not bounds-checked, causing out-of-bounds reads. This index is derived directly from untrusted received frames on the 802.15.4 radio link. The out-of-bounds read leads to malformed header reconstruction and can cause a denial-of-service by crashing or destabilizing the receiver. The vulnerability requires no privileges or user interaction and is triggered by crafted radio frames. The fix involves rejecting any destination index beyond the table size and aborting processing of malformed frames. No patch or official fix status is provided in the available data.

An unauthenticated attacker within radio range can send specially crafted 6LoWPAN frames that cause out-of-bounds reads in the IPHC uncompression code, leading to denial-of-service on the affected device. There is no confidentiality or integrity impact, and no data is leaked to the attacker. The impact is limited to availability disruption of the receiver processing the malformed frames.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The described fix rejects out-of-range destination indexes and aborts processing of malformed frames, preventing the vulnerability. Until an official patch is available, consider filtering or blocking suspicious 6LoWPAN frames at the network edge if possible.