Zephyr RTOS EUVD-2026-88473

Requires a build with CONFIG_NET_L2_IEEE802154_FRAGMENT enabled (the default whenever CONFIG_NET_6LO is set) so the vulnerable unfragmented copy branch exists. Exploitation is NOT possible over the air / from the radio - 6LoWPAN encode path length-checks IPv6 packets. It requires local on-device code that opens a NET_AF_PACKET socket (NET_SOCK_RAW, where the 6LoWPAN block is skipped, or NET_SOCK_DGRAM, which returns early on the address-family test) bound to an 802.15.4 interface, then sends a payload exceeding the 125-byte IEEE802154_MTU. For this to constitute a privilege-boundary crossing (unprivileged thread driving a supervisor-mode write via zsock_socket()/zsock_sendto() syscalls), the build must also have CONFIG_USERSPACE enabled; without CONFIG_USERSPACE the attacker already runs in-supervisor and this is a caller-side robustness defect only. Overrun size is limited to ~ll_hdr_len+3 bytes under the default CONFIG_NET_BUF_FIXED_DATA_SIZE (128 bytes) but can be much larger under CONFIG_NET_BUF_VARIABLE_DATA_SIZE.

The vendor CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H, base 6.3) is internally consistent with the description and I concur with it. This is a genuine supervisor-mode out-of-bounds write (CWE-787) but its real-world risk is bounded by several factors that keep it out of the critical tier. Attack vector is local (AV:L): the flaw is explicitly NOT reachable from the radio - for IPv6/6LoWPAN traffic ieee802154_6lo_encode_pkt() length-checks the whole packet and diverts oversized frames to the fragmentation path, so the vulnerable unfragmented branch only sees in-bounds copies. It is only reachable by an on-device application opening a NET_AF_PACKET socket (RAW or DGRAM) bound to an 802.15.4 interface, where the 6LoWPAN length validation is skipped. Complexity is High (AC:H) because it requires the specific build config (CONFIG_NET_L2_IEEE802154_FRAGMENT, default when CONFIG_NET_6LO is set) and, for a security boundary to be crossed, CONFIG_USERSPACE so an unprivileged thread can drive the kernel write via zsock syscalls; without USERSPACE the attacker is already in-process and this is a robustness/reliability defect rather than a privilege boundary crossing. PR:L reflects the userspace-thread case. There is NO EPSS score, NO CISA KEV listing, and NO public exploit code referenced - exploitation status is therefore 'no public exploit identified at time of analysis.' The overrun magnitude is configuration-dependent: bounded to ~ll_hdr_len+3 bytes with the default 128-byte fixed buffers, but potentially much larger under CONFIG_NET_BUF_VARIABLE_DATA_SIZE. Net: a real, patch-worthy memory-corruption bug in a widely-deployed RTOS, but a narrow trigger and local-only vector make it low-to-medium operational priority rather than an urgent fire.

On a Zephyr device built with CONFIG_NET_L2_IEEE802154_FRAGMENT and CONFIG_USERSPACE, an unprivileged application thread opens a NET_AF_PACKET RAW socket bound to the 802.15.4 interface and calls zsock_sendto() with a payload larger than the 125-byte IEEE802154_MTU. No length validation exists on that transmit path, so ieee802154_send() performs an unchecked net_buf_add_mem() into the fixed 125-byte tx_frame_buf_pool, writing attacker-chosen bytes past the buffer into adjacent kernel memory. No public exploit code is referenced; achieving controlled compromise rather than a crash requires favorable heap/pool adjacency (AC:H).