CVE-2026-19673: bounds in zephyrproject zephyr

The vulnerability arises because ethernet_recv() in Zephyr's Ethernet subsystem validates only that the first net_buf of a received frame holds a 14-byte Ethernet header. When the ethertype is 0x8100 (indicating VLAN tagging) and VLAN is enabled, the buffer is reinterpreted as an 18-byte VLAN Ethernet header without rechecking the buffer length. This leads to reading VLAN TCI and inner ethertype fields beyond the actual buffer length, causing net_buf_simple_pull() to remove more bytes than present. With assertions enabled, this triggers a panic; without, it causes a buffer length underflow and out-of-bounds memory access, enabling remote denial of service and potential information disclosure or corruption. The flaw affects only configurations built with CONFIG_NET_VLAN=y, VLAN enabled on the Ethernet interface, and no hardware VLAN tag stripping. The fix involves rejecting frames that fail length checks before VLAN header processing.

An unauthenticated attacker can send a specially crafted Ethernet frame with VLAN ethertype to trigger out-of-bounds memory access in the network stack. This results in a reliable remote denial of service due to node panic or memory corruption. In production builds without assertions, it can lead to information disclosure and memory corruption. The vulnerability affects only VLAN-enabled Ethernet interfaces without hardware VLAN tag stripping.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The described fix rejects frames that do not meet length requirements before VLAN header processing, preventing out-of-bounds access. Until a patch is applied, disabling VLAN support or enabling hardware VLAN tag stripping (ETHERNET_HW_VLAN_TAG_STRIP) on affected interfaces may mitigate the issue.