CVE-2026-75083

The receive path of the NXP KW41Z IEEE 802.15.4 driver, kw41zrx in drivers/ieee802154/ieee802154kw41z.c, computed the payload size as pktlen = len - KW41ZFCSLENGTH in a uint8t, where len is the frame length reported by the radio. The interrupt handler kw41zisr obtained that length from the...

CVE-2026-75083

The NXP KW41Z IEEE 802.15.4 driver contains an integer underflow vulnerability in the kw41z_rx() function within drivers/ieee802154/ieee802154_kw41z.c. The driver calculates payload size by subtracting KW41Z_FCS_LENGTH from the radio-reported frame length. Because the interrupt handler kw41z_isr(...