25 matches found
CVE-2026-75083
The receive path of the NXP KW41Z IEEE 802.15.4 driver, kw41zrx in drivers/ieee802154/ieee802154kw41z.c, computed the payload size as pktlen = len - KW41ZFCSLENGTH in a uint8t, where len is the frame length reported by the radio. The interrupt handler kw41zisr obtained that length from the...
EUVD-2026-101339
The receive path of the NXP KW41Z IEEE 802.15.4 driver, kw41zrx in drivers/ieee802154/ieee802154kw41z.c, computed the payload size as pktlen = len - KW41ZFCSLENGTH in a uint8t, where len is the frame length reported by the radio. The interrupt handler kw41zisr obtained that length from the...
CVE-2026-75083
The receive path of the NXP KW41Z IEEE 802.15.4 driver, kw41zrx in drivers/ieee802154/ieee802154kw41z.c, computed the payload size as pktlen = len - KW41ZFCSLENGTH in a uint8t, where len is the frame length reported by the radio. The interrupt handler kw41zisr obtained that length from the...
CVE-2026-75083 Integer underflow of the radio-reported frame length causes an out-of-bounds write in the NXP KW41Z IEEE 802.15.4 driver
The receive path of the NXP KW41Z IEEE 802.15.4 driver, kw41zrx in drivers/ieee802154/ieee802154kw41z.c, computed the payload size as pktlen = len - KW41ZFCSLENGTH in a uint8t, where len is the frame length reported by the radio. The interrupt handler kw41zisr obtained that length from the...
CVE-2026-75083 Integer underflow of the radio-reported frame length causes an out-of-bounds write in the NXP KW41Z IEEE 802.15.4 driver
The receive path of the NXP KW41Z IEEE 802.15.4 driver, kw41zrx in drivers/ieee802154/ieee802154kw41z.c, computed the payload size as pktlen = len - KW41ZFCSLENGTH in a uint8t, where len is the frame length reported by the radio. The interrupt handler kw41zisr obtained that length from the...
CVE-2026-75083
The NXP KW41Z IEEE 802.15.4 driver contains an integer underflow vulnerability in the kw41z_rx() function within drivers/ieee802154/ieee802154_kw41z.c. The driver calculates payload size by subtracting KW41Z_FCS_LENGTH from the radio-reported frame length. Because the interrupt handler kw41z_isr(...
CVE-2026-75083: Integer Underflow (Wrap or Wraparound)
The receive path of the NXP KW41Z IEEE 802.15.4 driver, kw41zrx in drivers/ieee802154/ieee802154kw41z.c, computed the payload size as pktlen = len - KW41ZFCSLENGTH in a uint8t, where len is the frame length reported by the radio. The interrupt handler kw41zisr obtained that length from the...
PT-2026-114279
The receive path of the NXP KW41Z IEEE 802.15.4 driver, kw41z rx in drivers/ieee802154/ieee802154 kw41z.c, computed the payload size as pkt len = len - KW41Z FCS LENGTH in a uint8 t, where len is the frame length reported by the radio. The interrupt handler kw41z isr obtained that length from the...
EUVD-2019-7532
Malware in sbrugna...
CVE-2019-17060
The Bluetooth Low Energy BLE stack implementation on the NXP KW41Z based on the MCUXpresso SDK with Bluetooth Low Energy Driver 2.2.1 and earlier does not properly restrict the BLE Link Layer header and executes certain memory contents upon receiving a packet with a Link Layer ID LLID equal to...
CVE-2019-17519
The Bluetooth Low Energy implementation on NXP SDK through 2.2.1 for KW41Z devices does not properly restrict the Link Layer payload length, allowing attackers in radio range to cause a buffer overflow via a crafted packet...
CVE-2019-17519
The Bluetooth Low Energy implementation on NXP SDK through 2.2.1 for KW41Z devices does not properly restrict the Link Layer payload length, allowing attackers in radio range to cause a buffer overflow via a crafted packet...
CVE-2019-17519
The Bluetooth Low Energy implementation on NXP SDK through 2.2.1 for KW41Z devices does not properly restrict the Link Layer payload length, allowing attackers in radio range to cause a buffer overflow via a crafted packet...
Buffer overflow
The Bluetooth Low Energy implementation on NXP SDK through 2.2.1 for KW41Z devices does not properly restrict the Link Layer payload length, allowing attackers in radio range to cause a buffer overflow via a crafted packet...
CVE-2019-17519
The Bluetooth Low Energy implementation on NXP SDK through 2.2.1 for KW41Z devices does not properly restrict the Link Layer payload length, allowing attackers in radio range to cause a buffer overflow via a crafted packet...
CVE-2019-17519
The CVE-2019-17519 issue affects NXP Bluetooth Low Energy in the KW41Z SDK (up to v2.2.1). The root cause is failure to properly restrict the Link Layer payload length, enabling attackers in radio range to trigger a buffer overflow with a crafted packet. The SweynTooth report and Red Hat/NVD refe...
CVE-2019-17519: Buffer Copy without Checking Size of Input
The Bluetooth Low Energy implementation on NXP SDK through 2.2.1 for KW41Z devices does not properly restrict the Link Layer payload length, allowing attackers in radio range to cause a buffer overflow via a crafted packet...
PT-2020-9912 · Nxp · Nxp Sdk For Kw41Z
Name of the Vulnerable Software and Affected Versions: NXP SDK for KW41Z devices versions through 2.2.1 Description: The Bluetooth Low Energy implementation does not properly restrict the Link Layer payload length, allowing attackers in radio range to cause a buffer overflow via a crafted packet...
CVE-2019-17060
The Bluetooth Low Energy BLE stack implementation on the NXP KW41Z based on the MCUXpresso SDK with Bluetooth Low Energy Driver 2.2.1 and earlier does not properly restrict the BLE Link Layer header and executes certain memory contents upon receiving a packet with a Link Layer ID LLID equal to...
Buffer overflow
The Bluetooth Low Energy BLE stack implementation on the NXP KW41Z based on the MCUXpresso SDK with Bluetooth Low Energy Driver 2.2.1 and earlier does not properly restrict the BLE Link Layer header and executes certain memory contents upon receiving a packet with a Link Layer ID LLID equal to...