CVE-2026-82962

ethernetfillheader in subsys/net/l2/ethernet/ethernet.c can prepend the Ethernet header in place, by pushing it into the headroom of the packet's first fragment, instead of allocating a separate header fragment. Before this fix the in-place path was selected purely from the build-time value of...

CVE-2026-82962 Out-of-bounds write in Zephyr Ethernet L2 when adding the link-layer header to a forwarded packet

ethernetfillheader in subsys/net/l2/ethernet/ethernet.c can prepend the Ethernet header in place, by pushing it into the headroom of the packet's first fragment, instead of allocating a separate header fragment. Before this fix the in-place path was selected purely from the build-time value of...

CVE-2026-82962

The Zephyr RTOS contains an out-of-bounds write vulnerability in subsys/net/l2/ethernet/ethernet.c within the ethernet_fill_header() function. The issue arises when the system attempts to prepend an Ethernet header in-place for packets that lack sufficient headroom, such as those produced by rout...

EUVD-2026-112266

ethernetfillheader in subsys/net/l2/ethernet/ethernet.c can prepend the Ethernet header in place, by pushing it into the headroom of the packet's first fragment, instead of allocating a separate header fragment. Before this fix the in-place path was selected purely from the build-time value of...