CVE-2026-19186

An integer underflow vulnerability exists in the ieee802154_decipher_data_frame() function within subsys/net/l2/ieee802154/ieee802154_frame.c . The software fails to verify if a received frame is long enough before subtracting header and authentication tag lengths from the total length. Because t...

CVE-2026-19186: Integer Underflow (Wrap or Wraparound)

ieee802154decipherdataframe in subsys/net/l2/ieee802154/ieee802154frame.c computed payloadlen = netpktgetlenpkt - llhdrlen - authtaglen without first checking that the received frame is at least llhdrlen + authtaglen bytes long. All three variables are uint8t, so a frame whose payload is shorter...