CVE-2026-75083: integer-overflow in zephyrproject zephyr

The vulnerability exists in the kw41z_rx() function of the NXP KW41Z IEEE 802.15.4 driver in Zephyr, where the payload size is computed as pkt_len = len - KW41Z_FCS_LENGTH using a uint8_t type. If the length field (len) is 1, pkt_len underflows to 255, causing an out-of-bounds write of up to 127 bytes beyond the allocated 128-byte buffer fragment. This memory corruption occurs in the shared receive buffer pool from interrupt context. The length field is derived from an unauthenticated PHY header byte received over the air, allowing an attacker within radio range to trigger the overflow by sending frames with a length byte of one. The overflow writes radio register contents rather than attacker-controlled data, bounding the integrity impact. The fix rejects lengths below KW41Z_FCS_LENGTH and checks buffer tailroom before copying, also covering the CONFIG_NET_L2_OPENTHREAD variant.

The vulnerability allows an attacker within IEEE 802.15.4 radio range to cause memory corruption in the Zephyr network buffer pool by sending frames with a crafted length byte. This can lead to crashes or corruption of other packets' data, resulting in denial of service. There is no direct confidentiality impact, and integrity impact is limited because the overflowed data originates from radio registers rather than attacker-controlled payload.

A fix is available that rejects any length below KW41Z_FCS_LENGTH and verifies buffer tailroom before copying data, preventing the integer underflow and buffer overflow. Users should apply the official patch or upgrade to a fixed version of Zephyr. Since this is not a cloud service, remediation requires updating the affected software. Patch status is confirmed by the vendor advisory describing the fix.