Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-19673— Out-of-bounds read and net_buf length underflow in Zephyr Ethernet L2 when parsing a truncated VLAN header

Quick assessment

Affected
zephyrproject zephyr
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

以下是该漏洞描述信息的中文翻译： 中的 函数仅验证接收到的帧的第一个 是否包含一个标准的 14 字节 。当以太网类型（ethertype）为 0x8100 且接口上启用了 VLAN 时，该缓冲区会被重新解释为 18 字节的 ，但并未重新检查长度。此时，VLAN TCI（标签控制信息）和内部以太网类型会从偏移量 14 到 17 处读取，这超出了 的范围。随后 被设置为 18，导致后续的 操作试图从缓冲区中移除比实际存在数据更多的字节。 仅需一个未经身份验证、长度为 14 至 17 字节、携带 VLAN 以太网类型的单

CVSS 7.1 · High EPSS 0.34% · P26

Affected Version Matrix 1

VendorProduct Version RangeStatus
zephyrproject zephyr 1.12.0< 4.5.0 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-19673

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Out-of-bounds read and net_buf length underflow in Zephyr Ethernet L2 when parsing a truncated VLAN header
Source: CVE Program / CVE List V5
Vulnerability Description
ethernet_recv() in subsys/net/l2/ethernet/ethernet.c validates only that the first net_buf of a received frame holds a plain 14-byte struct net_eth_hdr. When the ethertype is 0x8100 and VLAN is enabled on the interface, the same buffer is reinterpreted as the 18-byte struct net_eth_vlan_hdr without re-checking the length: the VLAN TCI and the inner ethertype are read from offsets 14..17, past pkt->buffer->len, and hdr_len is raised to 18 so the subsequent net_buf_pull() removes more bytes than the buffer holds. A single unauthenticated frame of 14 to 17 bytes carrying the VLAN ethertype triggers this. No knowledge of the node's VLAN configuration is needed: net_eth_get_vlan_iface() returns the base interface for the priority tag 0, and a broadcast destination address satisfies the "frame is for me" test, so a 16-byte broadcast frame with ethertype 0x8100 and TCI 0x0000 reaches the pull. Nothing in the receive path enforces the 60-byte Ethernet minimum — the USB CDC ECM and CDC NCM gadget classes in particular hand host-supplied frames of any non-zero length straight to net_recv_data(). With assertions enabled, net_buf_simple_pull() asserts and the node panics. In a production build (assertions and CONFIG_NET_BUF_HARDENING off) the uint16_t buffer length underflows to 65534 and buf->data is advanced past the end of the fragment's storage, so every later parser reads far outside the buffer and any net_buf_add() on that fragment computes tailroom from the underflowed length. The result is a reliable remote denial of service and out-of-bounds access with information-disclosure and corruption potential. Only configurations built with CONFIG_NET_VLAN=y that have a VLAN enabled on the receiving Ethernet interface, and whose MAC does not strip VLAN tags in hardware (ETHERNET_HW_VLAN_TAG_STRIP), are affected. The fix rejects the frame before the tag is read, so hdr_len is thereafter either 14 or 18 with both sizes validated against pkt->buffer->len.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
跨界内存读
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
zephyrproject zephyr 1.12.0 ~ 4.5.0 -

II. Public POCs for CVE-2026-19673

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-19673

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-19673 (1)

Other References for CVE-2026-19673 (1)

Same Patch Batch · zephyrproject · 2026-10-14 · 4 CVEs total

CVE-2026-75084 6.8 MEDIUM Out-of-bounds write in the TI CC1200 IEEE 802.15.4 driver from an unvalidated radio-suppli
CVE-2026-75083 5.9 MEDIUM Integer underflow of the radio-reported frame length causes an out-of-bounds write in the
CVE-2026-75085 4.2 MEDIUM Out-of-bounds read from received-frame length underflow in the STM32WBA IEEE 802.15.4 driv

IV. Related Vulnerabilities

Same product: zephyr
Same vendor: zephyrproject
Same weakness: CWE-125

V. Comments for CVE-2026-19673

No comments yet

Leave a comment