Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-75085— Out-of-bounds read from received-frame length underflow in the STM32WBA IEEE 802.15.4 driver

Quick assessment

Affected
zephyrproject zephyr
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

以下是该漏洞描述信息的中文翻译： STM32WBA 的 IEEE 802.15.4 驱动代码（位于 ）在计算接收帧的数据包长度时，使用了公式 ，但在执行减法之前，并未检查无线电报告的帧长度是否足以容纳 FCS（帧校验序列）。由于 是 （无符号 8 位整数）类型，当报告的长度为 0 或 1 时，结果会分别下溢为 254 或 255。对该值的唯一限制是 ，但在默认的生产配置（ ）中，该断言会被编译为空操作，即不执行任何检查。 该长度值源自 ST 链接层的“接收完成”元数据（ ，由 存储），最终来源于通过空中接收到的帧的

CVSS 4.2 · Medium EPSS 0.21% · P10

Affected Version Matrix 1

VendorProduct Version RangeStatus
zephyrproject zephyr 4.3.0≤ 4.4.2 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-75085

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Out-of-bounds read from received-frame length underflow in the STM32WBA IEEE 802.15.4 driver
Source: CVE Program / CVE List V5
Vulnerability Description
The STM32WBA IEEE 802.15.4 driver in drivers/ieee802154/ieee802154_stm32wba.c computed the packet length of a received frame as pkt_len = rx_frame->length - IEEE802154_FCS_LENGTH without first checking that the radio-reported length could hold an FCS. pkt_len is a uint8_t, so a reported length of 0 or 1 wrapped to 254 or 255. The only bound on the resulting value was __ASSERT_NO_MSG(pkt_len <= CONFIG_NET_BUF_DATA_SIZE), which compiles to nothing in the default production configuration (CONFIG_ASSERT=n). The length originates in the ST link-layer receive-done metadata (p_metadata->length, stored by stm32wba_802154_receive_done()), and ultimately in the PHY header of a frame received over the air, so it is influenced by any attacker within radio range of the device. Reaching the underflow requires the vendor link layer to surface a frame shorter than the FCS with no error; the driver performed no validation of its own on that value. When the underflow occurs, stm32wba_802154_rx_thread() calls net_pkt_write(pkt, rx_frame->psdu, pkt_len) with a length of about 254 bytes against a receive buffer that holds at most one PHY packet (IEEE802154_MAX_PHY_PACKET_SIZE, 127 bytes). This reads roughly 128 bytes past the end of the radio receive buffer and copies that adjacent memory into a network packet that is submitted to the networking stack, giving an out-of-bounds read with a potential disclosure of adjacent RAM plus needless oversized packet allocation in the RX thread. The fix rejects a frame whose reported length is smaller than IEEE802154_FCS_LENGTH before the subtraction, and replaces the compiled-out assertion with a runtime length check that drops oversized frames — matching the runtime check already present in drivers/ieee802154/ieee802154_nrf5.c.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
跨界内存读
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
zephyrproject zephyr 4.3.0 ~ 4.4.2 -

II. Public POCs for CVE-2026-75085

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-75085

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-75085 (1)

Other References for CVE-2026-75085 (1)

Same Patch Batch · zephyrproject · 2026-10-14 · 4 CVEs total

CVE-2026-19673 7.1 HIGH Out-of-bounds read and net_buf length underflow in Zephyr Ethernet L2 when parsing a trunc
CVE-2026-75084 6.8 MEDIUM Out-of-bounds write in the TI CC1200 IEEE 802.15.4 driver from an unvalidated radio-suppli
CVE-2026-75083 5.9 MEDIUM Integer underflow of the radio-reported frame length causes an out-of-bounds write in the

IV. Related Vulnerabilities

Same product: zephyr
Same vendor: zephyrproject
Same weakness: CWE-125

V. Comments for CVE-2026-75085

No comments yet

Leave a comment