CVE-2026-75084 zephyrproject CVE debrief

Who should care

Network administrators and security teams responsible for managing and securing IEEE 802.15.4 devices using the TI CC1200 driver should assess their exposure to this vulnerability and take necessary remediation steps.

Why it matters

This vulnerability allows an unauthenticated attacker within radio range to potentially cause a buffer overflow in the TI CC1200 IEEE 802.15.4 driver, leading to code execution or other security consequences. Network administrators and security teams should assess their exposure and take necessary remediation steps.

• Buffer overflow potentially leading to code execution
• Unauthenticated attacker can transmit malicious frames
• Radio range allows for exploitation without physical access
• No pairing, authentication, or user interaction required

Technical summary

The CC1200 sub-GHz IEEE 802.15.4 driver takes the PHY packet length from the first byte of the radio's RX FIFO in get_packet_length() and validates it in verify_rxfifo_validity(). However, the validation only enforces a lower bound (pkt_len < 3), and its second clause rejects a FIFO that holds more bytes than declared, never bounding large values. The driver configures the radio for variable packet length with PKT_LEN = 0xFF, allowing an over-the-air value of 0-255. This can be exploited by an attacker transmitting a frame with a length byte above 127, potentially causing a buffer overflow. The RX FIFO has a 128-byte limit, and the driver's failure to validate the packet length byte supplied by the radio can be

Defensive priority

High

Recommended defensive actions

• Review and apply the available patch from the vendor
• Restrict access to the affected system to only trusted sources
• Monitor network traffic for suspicious activity
• Consider implementing additional security measures such as encryption and authentication
• Perform a thorough review of the affected system's configuration and ensure that all necessary security patches are applied
• Implement a network monitoring system to detect and alert on potential exploitation attempts
• Conduct regular security audits to identify and address potential vulnerabilities

Evidence notes

The vulnerability is caused by the driver's failure to validate the packet length byte supplied by the radio. The RX FIFO has a 128-byte limit, but the driver configures the radio for variable packet length with PKT_LEN = 0xFF, allowing an over-the-air value of 0-255. An attacker can exploit this by transmitting a frame with a length byte above 127, potentially causing a buffer overflow.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.