7 matches found
CVE-2026-75083
The receive path of the NXP KW41Z IEEE 802.15.4 driver, kw41zrx in drivers/ieee802154/ieee802154kw41z.c, computed the payload size as pktlen = len - KW41ZFCSLENGTH in a uint8t, where len is the frame length reported by the radio. The interrupt handler kw41zisr obtained that length from the...
EUVD-2026-101339
The receive path of the NXP KW41Z IEEE 802.15.4 driver, kw41zrx in drivers/ieee802154/ieee802154kw41z.c, computed the payload size as pktlen = len - KW41ZFCSLENGTH in a uint8t, where len is the frame length reported by the radio. The interrupt handler kw41zisr obtained that length from the...
CVE-2026-75083
The receive path of the NXP KW41Z IEEE 802.15.4 driver, kw41zrx in drivers/ieee802154/ieee802154kw41z.c, computed the payload size as pktlen = len - KW41ZFCSLENGTH in a uint8t, where len is the frame length reported by the radio. The interrupt handler kw41zisr obtained that length from the...
CVE-2026-75083 Integer underflow of the radio-reported frame length causes an out-of-bounds write in the NXP KW41Z IEEE 802.15.4 driver
The receive path of the NXP KW41Z IEEE 802.15.4 driver, kw41zrx in drivers/ieee802154/ieee802154kw41z.c, computed the payload size as pktlen = len - KW41ZFCSLENGTH in a uint8t, where len is the frame length reported by the radio. The interrupt handler kw41zisr obtained that length from the...
CVE-2026-75083
The NXP KW41Z IEEE 802.15.4 driver contains an integer underflow vulnerability in the kw41z_rx() function within drivers/ieee802154/ieee802154_kw41z.c. The driver calculates payload size by subtracting KW41Z_FCS_LENGTH from the radio-reported frame length. Because the interrupt handler kw41z_isr(...
CVE-2026-75083 Integer underflow of the radio-reported frame length causes an out-of-bounds write in the NXP KW41Z IEEE 802.15.4 driver
The receive path of the NXP KW41Z IEEE 802.15.4 driver, kw41zrx in drivers/ieee802154/ieee802154kw41z.c, computed the payload size as pktlen = len - KW41ZFCSLENGTH in a uint8t, where len is the frame length reported by the radio. The interrupt handler kw41zisr obtained that length from the...
CVE-2026-75083: Integer Underflow (Wrap or Wraparound)
The receive path of the NXP KW41Z IEEE 802.15.4 driver, kw41zrx in drivers/ieee802154/ieee802154kw41z.c, computed the payload size as pktlen = len - KW41ZFCSLENGTH in a uint8t, where len is the frame length reported by the radio. The interrupt handler kw41zisr obtained that length from the...