CVE-2026-75085

The STM32WBA IEEE 802.15.4 driver in drivers/ieee802154/ieee802154_stm32wba.c is vulnerable to an out-of-bounds read due to a length underflow. The driver calculates packet length by subtracting IEEE802154_FCS_LENGTH from the radio-reported length without first verifying that the reported length ...

CVE-2026-75084

The TI CC1200 IEEE 802.15.4 driver contains an out-of-bounds write vulnerability in drivers/ieee802154/ieee802154_cc1200.c. The root cause is insufficient validation of the PHY packet length from the radio's RX FIFO in verify_rxfifo_validity(), which fails to bound large values when the radio is ...

CVE-2026-75083

The NXP KW41Z IEEE 802.15.4 driver contains an integer underflow vulnerability in the kw41z_rx() function within drivers/ieee802154/ieee802154_kw41z.c. The driver calculates payload size by subtracting KW41Z_FCS_LENGTH from the radio-reported frame length. Because the interrupt handler kw41z_isr(...