CVE-2026-13481: IEEE 1588 PTP Buffer Overflow Vulnerability

CVE-2026-13481 Overview

CVE-2026-13481 is an out-of-bounds read and bounded in-object write in the Zephyr RTOS IEEE 1588 Precision Time Protocol (PTP) management-message parser. The defect lives in subsys/net/lib/ptp/tlv.c, specifically in tlv_mgmt_post_recv(). The PTP_MGMT_TIME case casts mgmt_tlv->data to a 10-byte struct ptp_timestamp and byte-swaps it without validating that the TLV data field is large enough. Every sibling management id in the same switch validates its length first, but PTP_MGMT_TIME did not. Any adjacent attacker on the local PTP segment can send a crafted PTP_MSG_MANAGEMENT message when CONFIG_PTP is enabled.

Critical Impact
An adjacent-network attacker can trigger an 8-byte out-of-bounds read of adjacent in-object memory and corrupt the device's parsed management TIME value.

Affected Products

Zephyr RTOS builds with CONFIG_PTP enabled
subsys/net/lib/ptp/tlv.c PTP management-message parser
Devices exposing PTP on a local network segment

Discovery Timeline

2026-08-26 - CVE-2026-13481 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-13481

Vulnerability Analysis

The vulnerability sits in the receive path for PTP management messages. tlv_mgmt_post_recv() dispatches on the management id and, for PTP_MGMT_TIME, dereferences mgmt_tlv->data as a struct ptp_timestamp. The function then byte-swaps seconds_high, seconds_low, and nanoseconds, and writes the result back into the message buffer. The parser reads and writes 10 bytes regardless of the actual TLV data length.

The length passed into tlv_mgmt_post_recv() is tlv->length - 2. The upstream guard in ptp_tlv_post_recv() only enforces tlv->length > 2, while msg_tlv_post_recv() validates that the TLV fits within the received byte count but not a per-id minimum. A peer can therefore send a PTP_MGMT_TIME TLV with as little as 2 bytes of data, causing the parser to touch 8 bytes beyond the validated region. Message type and TLV contents come directly off the wire.

The access stays inside the struct ptp_msg allocation because mgmt_tlv->data lives in the leading mtu[NET_ETH_MTU] union member. Impact is limited to minor information exposure of adjacent in-object bytes and bounded corruption of the parsed timestamp. There is no crash on the access and no reachable reference-count corruption.

Root Cause

This is a classic out-of-bounds read [CWE-125] caused by missing input validation. The PTP_MGMT_TIME case was the only branch in the switch that omitted a per-id minimum length check before casting attacker-controlled TLV data to a fixed-size structure.

Attack Vector

Exploitation requires adjacent-network access to a Zephyr device with PTP enabled. The attacker sends a PTP_MSG_MANAGEMENT frame containing a PTP_MGMT_TIME TLV with a truncated data field. No authentication or user interaction is required. The result is disclosure of a few bytes of adjacent parsed message state and corruption of the device's PTP_MGMT_TIME value used downstream.

// Zephyr upstream fix in subsys/net/lib/ptp/tlv.c
// Source: https://github.com/zephyrproject-rtos/zephyr/commit/de98c3721a0e21ca269313997736f4f6193909ef
 		port_ds->mean_link_delay = net_ntohll(port_ds->mean_link_delay);
 		break;
 	case PTP_MGMT_TIME:
+		if (length < sizeof(struct ptp_timestamp)) {
+			return -EBADMSG;
+		}
 		ts = *(struct ptp_timestamp *)mgmt_tlv->data;
 
 		ts.seconds_high = net_ntohs(ts.seconds_high);

The patch adds a length guard matching the other management-id cases and returns -EBADMSG before the cast.

Detection Methods for CVE-2026-13481

Indicators of Compromise

Inbound PTP management messages of type PTP_MSG_MANAGEMENT carrying a PTP_MGMT_TIME TLV with length field less than 12 bytes (data smaller than sizeof(struct ptp_timestamp)).
Unexpected changes in a device's reported PTP management TIME value that do not correlate with legitimate grandmaster updates.
PTP peers sourcing management traffic from MAC addresses outside the sanctioned time-distribution fabric.

Detection Strategies

Inspect PTP traffic on UDP ports 319/320 or Ethernet type 0x88F7 for management TLVs and validate TLV length per management id.
Alert on any PTP_MGMT_TIME TLV where the data field is shorter than 10 bytes.
Baseline PTP management senders and flag new or unauthorized talkers on the local segment.

Monitoring Recommendations

Enable protocol-aware IDS signatures for malformed IEEE 1588 management TLVs at layer 2 and layer 3 boundaries.
Log parser return codes from tlv_mgmt_post_recv() on devices under your control and alert on -EBADMSG spikes after patching.
Correlate PTP time-source anomalies with adjacent-network device inventory to identify the origin of malformed frames.

How to Mitigate CVE-2026-13481

Immediate Actions Required

Apply the upstream Zephyr patch in commit de98c3721a0e21ca269313997736f4f6193909ef to subsys/net/lib/ptp/tlv.c and rebuild firmware.
Inventory devices with CONFIG_PTP enabled and prioritize those on shared or untrusted broadcast domains.
Segment PTP traffic onto a dedicated VLAN with explicit allow-lists for time sources and clients.

Patch Information

The fix is upstream in the Zephyr project. See the Zephyr commit de98c37 and the GitHub Security Advisory GHSA-mh5r-jxh8-hxwx. The patch adds a length check before casting mgmt_tlv->data to struct ptp_timestamp and returns -EBADMSG when the TLV is too short.

Workarounds

Disable CONFIG_PTP on Zephyr builds that do not require IEEE 1588 time synchronization.
Restrict PTP participation to a physically isolated or cryptographically bounded network segment.
Deploy switch-level filtering to drop PTP management messages from unauthorized MAC addresses.

bash

# Kconfig example - disable PTP where not required
CONFIG_PTP=n