CVE-2026-12632: Zephyr PTP Handler DoS Vulnerability

CVE-2026-12632 Overview

CVE-2026-12632 is an out-of-bounds read vulnerability [CWE-125] in the Zephyr real-time operating system's Precision Time Protocol (PTP) receive handler. The flaw lives in ptp_msg_post_recv() inside subsys/net/lib/ptp/msg.c, which reads a 4-bit message type from the wire and uses it to index the msg_size[] table without bounds checking. Undefined PTP message types 0xE and 0xF read past the end of the array. The out-of-bounds value is then reused as a length, extending the corruption into a TLV parsing loop that walks memory beyond the message slab.

Critical Impact
An unauthenticated attacker on the same link segment can crash any Zephyr node built with CONFIG_PTP by sending a single malformed PTP frame.

Affected Products

Zephyr RTOS with CONFIG_PTP enabled
Devices using subsys/net/lib/ptp/msg.c prior to commit 30dabd4c2f2e3641732c00111cd80b5c524c0136
Embedded and IoT deployments relying on Zephyr's Precision Time Protocol stack

Discovery Timeline

2026-08-18 - CVE-2026-12632 published to NVD
2026-08-19 - Last updated in NVD database

Technical Details for CVE-2026-12632

Vulnerability Analysis

The defect resides in Zephyr's PTP receive path. ptp_msg_type() extracts a 4-bit field via msg->header.type_major_sdo_id & 0xF, yielding values 0-15. The msg_size[] lookup table defines entries only up to PTP_MSG_MANAGEMENT (0xD), giving ARRAY_SIZE == 14. Message types 0xE and 0xF therefore index one or two int slots past the end of the array, producing an out-of-bounds read of adjacent read-only data.

The corrupted value cascades. It gates the length check msg_size[type] > cnt, and when the read yields a small or negative value the expression cnt - msg_size[type] produces a large positive budget that is passed to msg_tlv_post_recv(). The TLV loop then walks the message suffix beyond the received bytes, performing additional out-of-bounds reads and in-place byte-swap writes on memory outside the message slab.

Root Cause

The root cause is missing input validation on an attacker-controlled index. The PTP specification reserves message types 0xE and 0xF, but the Zephyr parser trusted the on-wire value without rejecting undefined types before the table lookup.

Attack Vector

PTP uses UDP multicast or raw Ethernet frames (EtherType 0x88F7) and is unauthenticated. ptp_port_event_gen() in subsys/net/lib/ptp/port.c reads a PTP frame with ptp_transport_recv() and calls ptp_msg_post_recv() with the attacker-chosen type. Any host on the same layer-2 segment can trigger the bug with no authentication and no user interaction. The reliably reproducible outcome is a fault or crash (denial of service); a memory-corruption path exists but depends on build-specific data adjacent to msg_size[], which an attacker cannot tune remotely.

 	int64_t current;
 	int tlv_len;
 
+	/* type is a 4-bit field (0-15) taken straight off the wire, but
+	 * msg_size[] only has entries up to PTP_MSG_MANAGEMENT. Reject
+	 * undefined types before indexing to avoid an out-of-bounds read.
+	 */
+	if (type >= ARRAY_SIZE(msg_size)) {
+		LOG_ERR("Received message with unsupported type");
+		return -EBADMSG;
+	}
+
 	if (msg_size[type] > cnt) {
 		LOG_ERR("Received message with incorrect length");
 		return -EBADMSG;

Source: Zephyr GitHub Commit 30dabd4c

Detection Methods for CVE-2026-12632

Indicators of Compromise

PTP frames on the local segment carrying message type values 0xE or 0xF in the lower 4 bits of the type_major_sdo_id header field.
Unexpected reboots, kernel faults, or watchdog resets on Zephyr nodes coincident with received PTP traffic.
Log entries containing Received message with unsupported type or Received message with incorrect length from the PTP subsystem.

Detection Strategies

Deploy passive network monitoring on segments carrying PTP traffic and alert on Ethernet frames with EtherType 0x88F7 that use reserved message types.
Correlate device crash telemetry with PTP multicast group activity (IPv4 224.0.1.129/224.0.0.107, IPv6 ff0x::181).
Fingerprint Zephyr builds with CONFIG_PTP=y running vulnerable versions of subsys/net/lib/ptp/msg.c.

Monitoring Recommendations

Enable verbose PTP logging on managed Zephyr fleets to surface -EBADMSG returns from ptp_msg_post_recv().
Track device uptime and unexpected reset counters on IoT and OT devices participating in PTP domains.
Baseline expected PTP participants and alert on new senders introduced to the link.

How to Mitigate CVE-2026-12632

Immediate Actions Required

Apply the upstream Zephyr patch that rejects type >= ARRAY_SIZE(msg_size) with -EBADMSG before any indexing.
Inventory devices with CONFIG_PTP enabled and prioritize firmware rebuilds for exposed nodes.
Restrict PTP traffic to trusted VLANs or point-to-point links until patched firmware is deployed.

Patch Information

The fix is upstream commit 30dabd4c2f2e3641732c00111cd80b5c524c0136 in subsys/net/lib/ptp/msg.c. It adds an explicit bounds check against ARRAY_SIZE(msg_size) and returns -EBADMSG for undefined message types before the table lookup. See the Zephyr Security Advisory GHSA-frjr-h396-7wh4 for the coordinated disclosure record.

Workarounds

Disable CONFIG_PTP in Kconfig for devices that do not require Precision Time Protocol.
Enforce layer-2 filtering to drop EtherType 0x88F7 frames and PTP UDP ports 319/320 at network ingress where PTP is not required.
Segment PTP domains behind managed switches that block untrusted endpoints from joining the multicast group.

bash

# Disable PTP in a Zephyr project configuration
# prj.conf
CONFIG_PTP=n

# Or rebuild against a patched Zephyr tree containing commit 30dabd4c
west update
west build -b <board> -p always <app>