CVE-2026-16512

gptphandlemsg in subsys/net/l2/ethernet/gptp/gptp.c dereferenced the gPTP header returned by GPTPHDR and switched on hdr-messagetype without first checking that the received frame carries at least sizeofstruct gptphdr 34 bytes of payload. The header accessor gptpgethdr deliberately never fails fo...