CVE-2026-87042

Name of the Vulnerable Software and Affected Versions (affected versions not specified)

Description The IEEE 1588 (PTP) port implementation in subsys/net/lib/ptp/port.c fails to validate the logMessageInterval field of received Delay Resp messages. The function port delay resp msg process() stores this raw value into port ds.log min delay req interval, which is subsequently used as a shift count by port timer set timeout() when arming the Delay Req timer. Values below approximately -30 truncate the timeout to zero, while values with a magnitude of 64 or more, including the standard "not applicable" encoding 0x7F, cause an undefined shift of a uint64 t.

Since PTP messages are received over unauthenticated link-local traffic, an attacker on the same link can inject a crafted Delay Resp message. If the delay timer is set to zero, the PTP thread continuously retransmits Delay Req messages, exhausting the CONFIG PTP MSG POLL SIZE message slab. This leads to ptp msg alloc() blocking indefinitely, stalling time synchronization until a reboot occurs. Alternatively, if buffers are recycled via a transmit-timestamp callback, the issue results in a multicast Delay Req flood and high CPU consumption, impacting the availability of the PTP subsystem and the local network segment.

Recommendations As a temporary mitigation, restrict the use of the logMessageInterval field in Delay Resp and Sync messages by implementing range checks to reject intervals outside the representable range and treating 0x7F as "not applicable". Restrict access to the PTP subsystem to trusted nodes on the local network segment to prevent the injection of crafted PTP messages.