CVE-2026-75083

The receive path of the NXP KW41Z IEEE 802.15.4 driver, kw41z rx() in drivers/ieee802154/ieee802154 kw41z.c, computed the payload size as pkt len = len - KW41Z FCS LENGTH in a uint8 t, where len is the frame length reported by the radio. The interrupt handler kw41z isr() obtained that length from the RX FRAME LENGTH field of the ZLL IRQSTS register — a copy of the PHY header length byte of the frame received over the air — and only rejected the value zero. A reported length of one therefore underflowed to pkt len == 255.

Because the packet is allocated with NET AF UNSPEC on a non-Ethernet L2, net pkt rx alloc with buffer() does not clamp the request to the interface MTU; with the default fixed-size buffer pool (CONFIG NET BUF FIXED DATA SIZE, CONFIG NET BUF DATA SIZE=128) the allocation succeeded as a chain of two fragments. The subsequent register-to-buffer copy loops write into the first fragment only, so 255 bytes were written into a 128-byte net buf data block, overrunning it by up to 127 bytes into adjacent network-buffer-pool memory, and reading up to 128 bytes past the end of the radio's PKT BUFFER RX register array.

The length field originates from an unauthenticated frame transmitted by any device within 802.15.4 radio range, and is captured by the hardware at PHY-header time — before frame filtering has completed — while the handler samples it after clearing the interrupt status, so an attacker flooding frames with a length byte of one can drive the underflow. The impact is memory corruption in the shared receive buffer pool from interrupt context, most plausibly a crash or corruption of other packets' data; the overflowing bytes are radio register contents rather than attacker-authored data, which bounds the integrity impact.

The fix rejects any length below KW41Z FCS LENGTH and additionally verifies net buf tailroom() of the first fragment before the copy loops, which also covers the CONFIG NET L2 OPENTHREAD variant of the size computation.