CVE-2026-75084

Name of the Vulnerable Software and Affected Versions CC1200 sub-GHz IEEE 802.15.4 driver (affected versions not specified)

Description An issue exists in the CC1200 sub-GHz IEEE 802.15.4 driver where the get packet length() function retrieves the PHY packet length from the radio's RX FIFO, but the verify rxfifo validity() function fails to enforce an upper bound on this value. Because the driver uses a variable packet length configuration, an unauthenticated attacker within radio range can transmit a frame with a length byte exceeding the IEEE 802.15.4 maximum of 127. When the read rxfifo content() function performs a single SPI burst read of the specified length into a network buffer fragment, it can write up to 127 bytes beyond the buffer's end. This leads to network-buffer-pool corruption and system crashes. The vulnerability affects builds that enable CONFIG IEEE802154 CC1200 with an attached CC1200 radio.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.