CVE-2026-5072 zephyrproject-rtos CVE debrief

Who should care

Zephyr maintainers, embedded product teams using Zephyr PTP, system integrators shipping time-synchronization features, and operators of devices exposed to untrusted network traffic on timing interfaces.

Technical summary

The supplied description says the vulnerable path accepts a negative log_announce_interval via a management message without sufficient validation. When port_timer_set_timeout_random later computes NSEC_PER_SEC >> -log_seconds, a sufficiently negative value can create an oversized shift count. In C, that is undefined behavior; depending on compiler and architecture, it may trap with an illegal instruction, crash the process, or yield a zero timeout that disrupts scheduling or timer behavior.

Defensive priority

High for deployments where the Zephyr PTP subsystem is enabled and reachable by untrusted peers; the impact is denial of service and potentially unstable timer logic.

Recommended defensive actions

• Apply the Zephyr fix or vendor update that adds bounds checking for log_announce_interval and the derived shift value.
• Limit exposure of PTP management and announce traffic to trusted, isolated network segments.
• If PTP is not required, disable the subsystem or related management functionality in affected builds.
• Monitor affected devices for unexpected crashes, resets, or timer starvation symptoms after PTP traffic is received.
• Review code paths that transform protocol values into shift counts and add explicit range validation before bitwise operations.

Evidence notes

The NVD record for CVE-2026-5072 is marked Received and references the Zephyr Project security advisory GHSA-3v98-458v-388r. The supplied vulnerability description states that a crafted PTP_MSG_MANAGEMENT message can set a negative log_announce_interval, and a later PTP_MSG_ANNOUNCE message can trigger undefined right-shift behavior in port_timer_set_timeout_random. This debrief relies only on the provided CVE description and official reference links.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.