CVE-2026-75084: bounds in zephyrproject zephyr

The CC1200 sub-GHz IEEE 802.15.4 driver in Zephyr reads the PHY packet length from the first byte of the radio's RX FIFO and validates it only with a lower bound check, failing to properly clamp large values. Since the radio is configured for variable packet length with PKT_LEN=0xFF, an attacker can transmit a frame with a length byte exceeding the IEEE 802.15.4 maximum of 127. This length is used to allocate network buffers and perform SPI burst reads without bounds checking, causing a write overflow past the end of the first fragment's buffer in the contiguous rx_bufs pool. The overflow corrupts the network buffer pool and can cause crashes. Exploitation requires being within radio range but no authentication or pairing is needed. The issue affects builds with CONFIG_IEEE802154_CC1200 enabled and attached CC1200 radio hardware.

An unauthenticated attacker within radio range can cause network buffer pool corruption and crashes on affected Zephyr devices by sending specially crafted frames with invalid length bytes. The overflow is not a controlled write of attacker data but results from FIFO underflow output, leading to denial of service via crashes. There is no confidentiality or integrity impact reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, disabling CONFIG_IEEE802154_CC1200 or avoiding use of the CC1200 radio driver can mitigate exposure. No other mitigations are specified.