Zephyr RTOS CVE-2026-75085

Exploitation requires the attacker to be within IEEE 802.15.4 radio range of an STM32WBA-based device running the vulnerable ieee802154_stm32wba.c driver (AV:A - not remotely reachable). The specific prerequisite is that the ST vendor link layer (stm32wba_802154_receive_done / p_metadata->length) must surface a received frame whose reported length is smaller than IEEE802154_FCS_LENGTH (2) with no error, which drives the uint8_t underflow; the driver itself performed no validation. The out-of-bounds read occurs in the default production configuration precisely because CONFIG_ASSERT=n compiles the __ASSERT_NO_MSG bound check to nothing - so hardened builds with CONFIG_ASSERT=y are NOT exploitable (the assert would catch it). Limiting factors: no internet reachability, high attack complexity due to dependence on vendor-firmware behavior outside attacker control, read-only impact with no code execution, and confinement to STM32WBA + 802.15.4 deployments only.

This is a genuinely low-priority issue whose signals align consistently toward limited real-world risk, despite being a memory-safety flaw. The provided CVSS 3.1 vector (AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L, base 4.2) tells a coherent story: exploitation is possible without authentication (PR:N) but requires adjacency - the attacker must be within IEEE 802.15.4 radio range (AV:A), not reachable over the internet - and carries high attack complexity (AC:H) because the trigger depends on a condition outside the attacker's direct control: the ST vendor link layer must surface a frame shorter than the FCS without flagging an error. Impact is a bounded out-of-bounds read (C:L) disclosing ~128 bytes of adjacent RAM into a network packet, plus minor availability pressure (A:L) from oversized packet allocation; there is no integrity impact (I:N) and no code execution. No EPSS score was provided, so exploitation probability cannot be quantified. The vulnerability is NOT on the CISA KEV list and no public exploit or POC was identified - only the upstream patch commit and a GHSA advisory are referenced. There are no conflicting signals here: the adjacency requirement, high complexity, read-only low-confidentiality impact, and absence of exploitation evidence all point to a defense-in-depth hardening fix rather than an actively dangerous flaw. The one caveat worth verifying is the practical reachability of the trigger - whether the STM32WBA radio firmware can in fact be coaxed into reporting a sub-FCS length, which the advisory treats as the precondition for reaching the underflow.

An attacker within IEEE 802.15.4 radio range of an STM32WBA-based Zephyr device transmits a malformed frame that causes the ST radio firmware to report a length of 0 or 1 (shorter than the 2-byte FCS). The uint8_t subtraction underflows to 254/255, and the RX thread reads ~128 bytes past the radio receive buffer into a network packet, disclosing adjacent RAM to the networking stack. No public POC exists at time of analysis; only the fixing commit and GHSA advisory are available.