Zephyr RTOS EUVD-2026-101339

Exploitation requires a Zephyr target that (1) uses the NXP KW41Z IEEE 802.15.4 radio driver (drivers/ieee802154/ieee802154_kw41z.c) and (2) runs the default fixed-size buffer pool configuration (CONFIG_NET_BUF_FIXED_DATA_SIZE with CONFIG_NET_BUF_DATA_SIZE=128), which allows the 255-byte request to allocate a two-fragment chain while the copy loop writes only the first 128-byte fragment. The attacker must be within 802.15.4 radio range (AV:A) and transmits unauthenticated frames with a PHY-header length byte of 1. Limiting factors: RF proximity is mandatory; there is no network-facing remote path; and success depends on a timing race (AC:H) because the length is latched at PHY-header time before frame filtering but sampled after the interrupt is cleared, so the attacker must flood length-one frames to drive the underflow. The affected code is also present in the CONFIG_NET_L2_OPENTHREAD size-computation variant.

This is a genuine but modest-priority memory-corruption flaw (CWE-191 integer underflow), not a high-severity emergency. The input CVSS of 5.9 (CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H) is internally consistent with the description: AV:A reflects that the triggering frame must be sent from within 802.15.4 radio range, AC:H reflects the race window (the length byte is latched at PHY-header time before frame filtering, then sampled after the interrupt is cleared, requiring the attacker to flood length-one frames to win the timing), and PR:N/UI:N correctly reflect that the malformed frame is unauthenticated and needs no user interaction. C:N is appropriate because the over-read exposes radio register contents to buffer memory rather than to the attacker, and the description explicitly notes the overflowing bytes are radio register contents rather than attacker-authored data, which bounds integrity to I:L; A:H reflects the realistic crash/pool-corruption outcome. No EPSS score, KEV listing, POC, or SSVC decision data was provided, so exploitation-probability and automatability signals cannot be weighed - but the combination of adjacent-only vector, high attack complexity, and the fact that an attacker cannot control the corrupting bytes makes weaponization into reliable code execution unlikely; a denial-of-service crash is the most plausible real-world impact. Net: real and worth patching on affected KW41Z deployments, but not a drop-everything issue absent any exploitation evidence.

An attacker with an 802.15.4 radio positioned within RF range of a Zephyr device using the NXP KW41Z driver floods the air with frames whose PHY-header length byte is set to 1. When the driver samples that length, the uint8_t subtraction underflows to 255 and the receive path writes 255 bytes into a 128-byte net_buf fragment, overrunning the shared RX buffer pool from interrupt context. No public exploit identified at time of analysis; the attack requires winning a timing race (AC:H) and yields corruption/crash rather than attacker-controlled code execution.