CVE-2026-75085

Awaiting Analysis Awaiting Analysis - Queue

Buffer Underflow in STM32WBA IEEE 802.15.4 Driver

Publication date: 2026-10-14

Last updated on: 2026-10-16

Assigner: Zephyr Project

Description

The STM32WBA IEEE 802.15.4 driver in drivers/ieee802154/ieee802154_stm32wba.c computed the packet length of a received frame as pkt_len = rx_frame->length - IEEE802154_FCS_LENGTH without first checking that the radio-reported length could hold an FCS. pkt_len is a uint8_t, so a reported length of 0 or 1 wrapped to 254 or 255. The only bound on the resulting value was __ASSERT_NO_MSG(pkt_len <= CONFIG_NET_BUF_DATA_SIZE), which compiles to nothing in the default production configuration (CONFIG_ASSERT=n). The length originates in the ST link-layer receive-done metadata (p_metadata->length, stored by stm32wba_802154_receive_done()), and ultimately in the PHY header of a frame received over the air, so it is influenced by any attacker within radio range of the device. Reaching the underflow requires the vendor link layer to surface a frame shorter than the FCS with no error; the driver performed no validation of its own on that value. When the underflow occurs, stm32wba_802154_rx_thread() calls net_pkt_write(pkt, rx_frame->psdu, pkt_len) with a length of about 254 bytes against a receive buffer that holds at most one PHY packet (IEEE802154_MAX_PHY_PACKET_SIZE, 127 bytes). This reads roughly 128 bytes past the end of the radio receive buffer and copies that adjacent memory into a network packet that is submitted to the networking stack, giving an out-of-bounds read with a potential disclosure of adjacent RAM plus needless oversized packet allocation in the RX thread. The fix rejects a frame whose reported length is smaller than IEEE802154_FCS_LENGTH before the subtraction, and replaces the compiled-out assertion with a runtime length check that drops oversized frames — matching the runtime check already present in drivers/ieee802154/ieee802154_nrf5.c.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-16

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-75085

EUVD

EUVD-2026-101342

Affected Vendors & Products

Vendor	Product	Version / Range
zephyrproject	zephyr	4.3.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-125	The product reads data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

Executive Summary

This vulnerability is an out-of-bounds read issue in the STM32WBA IEEE 802.15.4 driver within the Zephyr RTOS project. The driver calculates packet length by subtracting the Frame Check Sequence (FCS) length from the radio-reported frame length without validating if the reported length can hold the FCS. Since the length is stored as an 8-bit unsigned integer, a reported length of 0 or 1 causes an underflow, wrapping the value to 254 or 255. This leads to reading about 128 bytes past the intended buffer (max 127 bytes), copying adjacent memory into a network packet and submitting it to the networking stack.

The issue stems from untrusted input from the radio, allowing attackers within range to craft malicious frames triggering the vulnerability. The fix rejects frames with reported lengths smaller than the FCS length before subtraction and adds a runtime check to drop oversized frames.

Detection Guidance

Detection requires monitoring for oversized packets or memory corruption in the STM32WBA IEEE 802.15.4 driver. Check Zephyr RTOS logs for buffer overflow warnings or unusual packet sizes. Use network sniffers like Wireshark to inspect IEEE 802.15.4 frames for lengths smaller than the FCS (2 bytes).

Commands: 1) Inspect Zephyr logs: dmesg | grep -i 'ieee802154' or journalctl -u zephyr-* 2) Monitor network traffic: tcpdump -i any -y ieee802_15_4 -c 100 3) Check for crashes or memory corruption in the driver.

Impact Analysis

This vulnerability allows an attacker within radio range to cause an out-of-bounds read, potentially disclosing adjacent RAM contents and triggering unnecessary large packet allocations in the RX thread. This could lead to memory corruption, crashes, or unintended data exposure depending on the system's memory layout.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by enabling unauthorized memory disclosure and buffer overflows. An attacker within radio range could exploit the out-of-bounds read to access adjacent RAM, potentially exposing sensitive data processed by the device. This may violate data protection requirements under GDPR (e.g., Article 32 on security of processing) and HIPAA (e.g., Security Rule safeguards for integrity and confidentiality).

Mitigation Strategies

Upgrade Zephyr RTOS to version 4.5.0 or later to apply the fix. If upgrading is not possible, apply the patch from commit 46f8af4f5ee472abc13b0291c44fdfe4ed879aaa manually. Disable IEEE 802.15.4 radio interfaces if not in use to reduce attack surface.

Hi! I’m here to help you understand CVE-2026-75085. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70