PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-75083 zephyrproject CVE debrief

Integer underflow of the radio-reported frame length causes an out-of-bounds write in the NXP KW41Z IEEE 802.15.4 driver. The vulnerability occurs in the receive path of the driver, specifically in the kw41z_rx() function in drivers/ieee802154/ieee802154_kw41z.c. The interrupt handler kw41z_isr() obtains the frame length from the RX_FRAME_LENGTH field of the ZLL IRQSTS register, which is a copy of the PHY header length byte of the frame received over the air. A reported length of one underflows to pkt_len == 255, causing an out-of-bounds write. This could potentially lead to a denial of service or code execution.

Vendor
zephyrproject
Product
zephyr
CVSS
MEDIUM 5.9
CISA KEV
Not listed in stored evidence
Original CVE published
2026-10-14
Original CVE updated
2026-10-16
Advisory published
2026-10-14
Advisory updated
2026-10-16

Who should care

Defenders responsible for Zephyr-based systems using the NXP KW41Z IEEE 802.15.4 driver, particularly those using versions prior to 4.5.0, should assess exposure and prioritize patching.

Why it matters

CVE-2026-75083 is an integer underflow vulnerability in the NXP KW41Z IEEE 802.15.4 driver in Zephyr. Defenders should prioritize patching and verifying configurations to prevent potential denial of service or code execution.

  • Potential denial of service due to out-of-bounds write
  • Possible code execution with malicious input
  • Verification of patch application and configuration settings required
  • Monitoring of network-buffer-pool memory recommended

Technical summary

The receive path of the NXP KW41Z IEEE 802.15.4 driver is vulnerable to an integer underflow, allowing for an out-of-bounds write. This could potentially lead to a denial of service or code execution. The vulnerability occurs in the kw41z_rx() function in drivers/ieee802154/ieee802154_kw41z.c, where the frame length reported by the radio is used to compute the payload size. A reported length of one underflows to pkt_len == 255, causing an out-of-bounds write. Defenders should prioritize verifying and applying patches for the NXP KW41Z IEEE 802.15.4 driver in Zephyr versions prior to 4.5.0.

Defensive priority

Defenders should prioritize verifying and applying patches for the NXP KW41Z IEEE 802.15.4 driver in Zephyr versions prior to 4.5.0.

Recommended defensive actions

  • Verify and apply patches for the NXP KW41Z IEEE 802.15.4 driver in Zephyr versions prior to 4.5.0
  • Review and update Zephyr configurations to ensure CONFIG_NET_BUF_FIXED_DATA_SIZE and CONFIG_NET_BUF_DATA_SIZE are set correctly
  • Monitor network-buffer-pool memory for potential overruns
  • Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
  • Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
  • Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and source item provide details on the integer underflow vulnerability in the NXP KW41Z IEEE 802.15.4 driver. The vulnerability allows for an out-of-bounds write, potentially leading to a denial of service or code execution.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-75083 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-75083

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-75083 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-75083

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.