CVE-2026-19673 Out-of-bounds read and net_buf length underflow in Zephyr Ethernet L2 when parsing a truncated VLAN header

ethernetrecv in subsys/net/l2/ethernet/ethernet.c validates only that the first netbuf of a received frame holds a plain 14-byte struct netethhdr. When the ethertype is 0x8100 and VLAN is enabled on the interface, the same buffer is reinterpreted as the 18-byte struct netethvlanhdr without...

CVE-2026-19673 Out-of-bounds read and net_buf length underflow in Zephyr Ethernet L2 when parsing a truncated VLAN header

ethernetrecv in subsys/net/l2/ethernet/ethernet.c validates only that the first netbuf of a received frame holds a plain 14-byte struct netethhdr. When the ethertype is 0x8100 and VLAN is enabled on the interface, the same buffer is reinterpreted as the 18-byte struct netethvlanhdr without...

CVE-2026-19673

The Zephyr RTOS Ethernet L2 layer contains an out-of-bounds read and net_buf length underflow in subsys/net/l2/ethernet/ethernet.c. When parsing a truncated VLAN header (ethertype 0x8100), the ethernet_recv() function fails to re-verify the buffer length when reinterpreting the header as an 18-by...