The vulnerability in Zephyr's ieee802154_send() arises from an unchecked net_buf_add_mem() call that copies packet data into a fixed-size 125-byte buffer without sufficient bounds checking when 6LoWPAN fragmentation is disabled or bypassed. While IPv6 packets are protected by length checks and fragmentation, raw and datagram sockets bound to 802.15.4 interfaces lack these checks, allowing an application or unprivileged thread to cause a supervisor-mode out-of-bounds write. The overrun size depends on configuration but can be several bytes beyond the buffer, leading to memory corruption and potential kernel compromise. The fix introduced length validation against IEEE802154_MTU and a safer copying helper that returns an error instead of overrunning buffers, also linearizing net_buf chains into single MAC frames.

An attacker with the ability to send packets via NET_AF_PACKET sockets on an 802.15.4 interface can cause a bounded out-of-bounds write past a fixed transmit buffer, leading to memory corruption. This can result in a system crash or compromise of kernel state, impacting system integrity and availability. The vulnerability requires local access and elevated privileges (low privilege but supervisor mode) and has no confidentiality impact but high integrity and availability impact.

A fix is available in Zephyr version 4.4.2 that adds proper length validation before copying data into the transmit buffer and replaces unsafe buffer copying with a helper that returns an error on oversized packets. Users should upgrade to version 4.4.2 or later. No other mitigation is indicated or required as the vulnerability is addressed by the official fix.