CVE-2026-18415

The Zephyr RTOS (implied by CONFIG_NET_L2_IEEE802154_FRAGMENT and zsock_socket()) contains an out-of-bounds write vulnerability in the ieee802154_send() function within subsys/net/l2/ieee802154/ieee802154.c. When CONFIG_NET_L2_IEEE802154_FRAGMENT is enabled, the system fails to perform length val...

CVE-2026-18415 Out-of-bounds write in the IEEE 802.15.4 L2 transmit path for oversized non-6LoWPAN frames

ieee802154send in subsys/net/l2/ieee802154/ieee802154.c copies the outgoing packet into a single fixed 125-byte transmit buffer txframebufpool, sized IEEE802154MTU. In builds with CONFIGNETL2IEEE802154FRAGMENT enabled the default whenever CONFIGNET6LO is set, the branch taken when 6LoWPAN...

CVE-2026-18415 Out-of-bounds write in the IEEE 802.15.4 L2 transmit path for oversized non-6LoWPAN frames

ieee802154send in subsys/net/l2/ieee802154/ieee802154.c copies the outgoing packet into a single fixed 125-byte transmit buffer txframebufpool, sized IEEE802154MTU. In builds with CONFIGNETL2IEEE802154FRAGMENT enabled the default whenever CONFIGNET6LO is set, the branch taken when 6LoWPAN...

CVE-2026-18415: Out-of-bounds Write

ieee802154send in subsys/net/l2/ieee802154/ieee802154.c copies the outgoing packet into a single fixed 125-byte transmit buffer txframebufpool, sized IEEE802154MTU. In builds with CONFIGNETL2IEEE802154FRAGMENT enabled the default whenever CONFIGNET6LO is set, the branch taken when 6LoWPAN...