CVE-2026-75085: bounds in zephyrproject zephyr

The STM32WBA IEEE 802.15.4 driver in Zephyr incorrectly computes the packet length of received frames by subtracting the IEEE802154_FCS_LENGTH from the radio-reported length without verifying that the reported length is sufficient to hold the FCS. Because pkt_len is a uint8_t, a reported length of 0 or 1 causes an underflow, wrapping pkt_len to 254 or 255. This leads to an out-of-bounds read when the driver copies data beyond the radio receive buffer into a network packet, potentially disclosing adjacent RAM contents. The vulnerability arises from lack of validation of the radio-reported length and the absence of runtime checks in production builds. The fix involves rejecting frames with lengths smaller than the FCS before subtraction and adding runtime length checks to drop oversized frames, aligning with existing checks in other drivers.

An attacker within radio range can send frames with manipulated lengths that cause the driver to read beyond the allocated buffer, resulting in out-of-bounds memory reads. This can lead to disclosure of adjacent RAM contents and unnecessary large memory allocations in the receive thread. The vulnerability does not allow privilege escalation or code execution but can impact confidentiality and availability of the affected device's network stack.

A fix is available that rejects frames with reported lengths smaller than the IEEE802154_FCS_LENGTH and enforces runtime length checks to drop oversized frames. Users should update to the fixed versions of Zephyr (versions after 4.4.2) where these checks are implemented. Until patched, no effective mitigation is possible because the vulnerability arises from the radio frame length processing. Monitoring or filtering radio traffic may reduce risk but is not a direct fix.