CVE-2026-19186: IEEE 802.15.4 Buffer Overflow DOS Vulnerability

CVE-2026-19186 Overview

CVE-2026-19186 is an integer underflow vulnerability [CWE-191] in the Zephyr RTOS IEEE 802.15.4 Layer 2 stack. The flaw lives in ieee802154_decipher_data_frame() within subsys/net/l2/ieee802154/ieee802154_frame.c. A uint8_t subtraction of ll_hdr_len and authtag_len from the frame length wraps when the frame is shorter than the authentication tag. The wrapped length drives a CCM operation that reads and writes hundreds of bytes past the packet buffer. A single crafted short frame from any device in radio range triggers the condition without authentication.

Critical Impact
Out-of-bounds read and write of up to ~240 bytes into the adjacent network-buffer pool, corrupting other packets or allocator metadata and typically crashing the target device.

Affected Products

Zephyr RTOS builds with CONFIG_NET_L2_IEEE802154_SECURITY enabled
Deployments selecting a crypto device via CONFIG_NET_L2_IEEE802154_SECURITY_CRYPTO_DEV_NAME
Sessions established with any security level other than IEEE802154_SECURITY_LEVEL_NONE

Discovery Timeline

2026-10-07 - CVE-2026-19186 published to NVD
2026-10-07 - Last updated in NVD database

Technical Details for CVE-2026-19186

Vulnerability Analysis

The decryption path in ieee802154_decipher_data_frame() computes payload_len = net_pkt_get_len(pkt) - ll_hdr_len - authtag_len without validating the frame length. All three operands are declared uint8_t. When the received frame is shorter than ll_hdr_len + authtag_len, the subtraction underflows and produces a value up to 255.

The underflowed length is passed to ieee802154_decrypt_auth() and then to the CCM operation as cipher_pkt.in_len and out_buf_max. The pointer apkt->tag is set to frame + ll_hdr_len + payload_len, falling well outside the allocated buffer. The crypto layer reads several hundred bytes past the end of the receive buffer and writes the decrypted output back in place over adjacent memory.

Root Cause

The root cause is a missing length precondition before an unsigned 8-bit subtraction. ieee802154_validate_frame() accepts a data frame with a one-byte payload, so the length check never guards the arithmetic. Authentication tag verification occurs only after the CCM operation completes, so corrupted memory persists even when the tag check fails.

Attack Vector

Exploitation requires radio-range access to the target but no key material, prior association, or authentication. An attacker transmits a single data frame whose total length is less than the sum of the link-layer header and the configured authentication tag length. The frame is accepted, the length underflows, and the CCM operation corrupts the network-buffer pool. The out-of-bounds content is ciphertext XORed against keystream over out-of-bounds memory, so the attacker does not control the written bytes.

 
 	/* Let's encrypt/auth only in the end, if needed */
 	authtag_len = level_2_authtag_len[level];
+	if (buf->len < (size_t)(ll_hdr_len + authtag_len)) {
+		NET_ERR("Frame too short to encrypt: len %u < ll_hdr %u + authtag %u",
+			buf->len, ll_hdr_len, authtag_len);
+		goto out;
+	}
 	payload_len = buf->len - ll_hdr_len - authtag_len;
 	if (!ieee802154_encrypt_auth(&ctx->sec_ctx, buf_start, ll_hdr_len,
 				     payload_len, authtag_len, ctx->ext_addr)) {

Source: Zephyr commit 6d721de1. The patch adds an explicit length guard before the subtraction on both the transmit and receive paths.

Detection Methods for CVE-2026-19186

Indicators of Compromise

Unexpected device resets or kernel faults on Zephyr nodes using IEEE 802.15.4 security
Log entries from ieee802154_decrypt_auth() reporting tag verification failures preceded by anomalous packet drops
Corrupted network-buffer pool contents observed in post-mortem crash dumps

Detection Strategies

Enable verbose logging in the IEEE 802.15.4 L2 stack and alert on repeated authentication tag failures from the same source address
Monitor over-the-air traffic for data frames whose payload length is smaller than the configured authentication tag length
Correlate device crash telemetry with proximity-based wireless events on the 802.15.4 channel

Monitoring Recommendations

Instrument field devices to report unexpected reboots and watchdog resets to a central telemetry collector
Deploy an 802.15.4 sniffer in sensitive deployments to capture malformed frames for forensic analysis
Track frame-length distributions and flag deviations from protocol expectations

How to Mitigate CVE-2026-19186

Immediate Actions Required

Apply the upstream Zephyr fix from commit 6d721de1 to all affected firmware images
Audit project prj.conf files for CONFIG_NET_L2_IEEE802154_SECURITY usage and confirm the patched tree is in use before deployment
Rebuild and reflash fielded devices that enable the experimental 802.15.4 security option

Patch Information

The fix is published in Zephyr commit 6d721de13a6026808f75578ecfee95a3592d5264 and tracked in GHSA-6x64-rwq6-j8x3. The patch rejects frames shorter than ll_hdr_len + authtag_len before the subtraction and adds the matching guard in ieee802154_create_data_frame() on the transmit side.

Workarounds

Disable CONFIG_NET_L2_IEEE802154_SECURITY where the experimental feature is not required
Operate the stack at IEEE802154_SECURITY_LEVEL_NONE, which sets authtag_len to zero and prevents the underflow
Restrict physical radio range or deploy in RF-shielded environments until patched firmware is deployed

bash

# Disable the experimental 802.15.4 security option in prj.conf
CONFIG_NET_L2_IEEE802154_SECURITY=n