CVE-2026-19673 zephyrproject CVE debrief

Who should care

Defenders responsible for Zephyr-based systems, especially those with unauthenticated access to Ethernet networks, should assess exposure and prioritize patching or mitigation. This includes operators managing affected deployments, vulnerability management teams, and security teams responsible for monitoring and incident response.

Why it matters

This vulnerability in Zephyr's Ethernet L2 implementation can cause a node panic if assertions are enabled, and defenders should prioritize patching or mitigation, especially in systems with unauthenticated access to Ethernet networks.

• Potential node panic if assertions are enabled
• Unauthenticated attacker can trigger the vulnerability with a single frame
• No knowledge of the node's VLAN configuration is needed

Technical summary

The `ethernet_recv()` function in Zephyr's Ethernet L2 implementation fails to properly validate the length of received frames when the ethertype is 0x8100 and VLAN is enabled. This can cause an out-of-bounds read and net_buf length underflow when parsing a truncated VLAN header. A single unauthenticated frame of 14 to 17 bytes carrying the VLAN ethertype triggers this. No knowledge of the node's VLAN configuration is needed: net_eth_get_vlan_iface() returns the base interface for the priority tag 0, and a broadcast destination address satisfies the 'frame is for me' test, so a 16-byte broadcast frame with ethertype 0x8100 and TCI 0x0000 reaches the pull. Nothing in the receive path enforces the 60-byte minimum

Defensive priority

Defenders should prioritize patching or mitigating this vulnerability, especially in systems where unauthenticated access to Ethernet networks is possible.

Recommended defensive actions

• Patch Zephyr to version 4.5.0 or later
• Implement network input validation to prevent truncated frames
• Monitor network traffic for suspicious activity
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source item provide details on the vulnerability, including its impact on Zephyr's Ethernet L2 implementation. However, the corpus does not establish versions, exploitation, impact, or remediation beyond the provided information.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.