CVE-2026-18415 zephyrproject CVE debrief

Who should care

Developers and administrators using Zephyr's IEEE 802.15.4 subsystem should assess their exposure and apply the patch provided by the vendor. This vulnerability can lead to memory corruption and potential system crashes or further compromise. Affected operators, platforms, and security teams should review and validate packet lengths before copying them into transmit buffers. They should also use CONFIG_ASSERT to enable assertions and prevent buffer over

Why it matters

An out-of-bounds write vulnerability exists in the ieee802154_send() function of Zephyr's IEEE 802.15.4 subsystem. The function fails to validate packet lengths when CONFIG_NET_L2_IEEE802154_FRAGMENT is enabled, allowing an attacker to overflow a fixed-size transmit buffer. This can lead to memory corruption and potential system crashes or further compromise. Developers and administrators using Zephyr's IEEE 802.15.4 subsystem should assess their exposure and apply the patch provided by the vendor.

• Potential system crashes due to memory corruption
• Possible further compromise of kernel state
• Corruption of memory adjacent to the pool buffer

Technical summary

The ieee802154_send() function in Zephyr's IEEE 802.15.4 subsystem does not validate packet lengths when CONFIG_NET_L2_IEEE802154_FRAGMENT is enabled. This allows an attacker to overflow a fixed-size transmit buffer, leading to memory corruption and potential system crashes or further compromise. The function copies the outgoing packet into a single fixed 125-byte transmit buffer without validating the packet length. This can be exploited by an application or an unprivileged application thread using the zsock_socket()/zsock_sendto() syscalls to drive a supervisor-mode out-of-bounds write. The defect is not reachable from the radio: for NET_AF_INET6 packets ieee802154_6lo_encode_pkt() compares the whole packet

Defensive priority

High

Recommended defensive actions

• Review and apply the patch provided by the vendor
• Validate packet lengths before copying them into transmit buffers
• Use CONFIG_ASSERT to enable assertions and prevent buffer overflows
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The vulnerability is caused by an unchecked net_buf_add_mem() call in the ieee802154_send() function. The function copies the outgoing packet into a single fixed 125-byte transmit buffer without validating the packet length. This can be exploited by an application or an unprivileged application thread using the zsock_socket()/zsock_sendto() syscalls to drive a supervisor-mode out-of-bounds write.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.