CVE-2026-19186

Executive Summary

CVE-2026-19186 is an out-of-bounds read/write vulnerability in the 802.15.4 link-layer implementation of the Zephyr RTOS (ieee802154_decipher_data_frame() in subsys/net/l2/ieee802154/ieee802154_frame.c). Because the frame length subtraction uses uint8_t arithmetic without validating that the received frame is at least ll_hdr_len + authtag_len bytes, a single crafted short frame from any device in radio range causes a length wrap-around of up to 255 bytes and unbounded memory access past the receive buffer. Any unauthenticated 802.15.4 neighbor can trigger memory corruption, packet/allocator corruption, and typically a denial-of-service fault on the target node.

Technical Analysis

The defective computation is a length derivation performed before any length-sufficiency check:

payload_len = net_pkt_get_len(pkt) - ll_hdr_len - authtag_len

All three operands are uint8_t. When the received frame payload is shorter than the configured authentication tag length, the subtraction underflows and wraps to a large value (up to 255). The wrapped length is passed unchanged into ieee802154_decrypt_auth() and onward to the CCM cryptographic operation as cipher_pkt.in_len / out_buf_max, with apkt->tag pointing at frame + ll_hdr_len + payload_len.

Two independent defects compound here:

1. Missing pre-condition validation (CWE-191, integer underflow): No check confirms net_pkt_get_len(pkt) >= ll_hdr_len + authtag_len before the subtraction. The described frame validation path, ieee802154_validate_frame(), does not catch the case — a data frame with a one-byte payload is accepted.

2. Processing before authentication: The frame's authentication tag is verified only after the CCM operation and the copy-back have already occurred. Consequently the attacker requires no key material, no prior association, and no valid authentication tag. This is the decisive property: it converts a crypto-adjacent bug into an unauthenticated remote-triggerable memory-safety issue.

Because the receive buffer is allocated to the exact length of the frame delivered by the radio driver, the crypto layer reads several hundred bytes beyond the end of the packet buffer and writes the same number of decrypted bytes back over it in place. The result is a coupled out-of-bounds read and out-of-bounds write of roughly 240 bytes into the adjacent network-buffer pool, corrupting neighboring packets or allocator metadata and typically faulting the device.

The out-of-bounds content is explicitly noted as not attacker-chosen — it is a function of ciphertext XOR keystream over adjacent memory. This constrains the primitive to memory corruption/DoS rather than a controlled write; it does not enable arbitrary write-what-where directly. Note that the description text is truncated at "it is ciphertext XOR", so the downstream consequences of the recovered plaintext cannot be fully characterized from the available data.

Fundamentally this is a wireless-reachable, unauthenticated, pre-authentication memory-safety flaw in an embedded network stack. Severity is driven by the network stack's role in safety- and availability-critical deployments.

Exploitation Scenarios

No public PoC or exploit code exists for this CVE. The following chain is derived strictly from the described code path and vulnerability class. No function names, endpoints, or parameters beyond those in the description are asserted.

1. Reconnaissance / target identification. The attacker must be within radio range of a device running a Zephyr-based 802.15.4 stack (e.g., Thread, Zigbee-adjacent, or custom 802.15.4 deployments). Identification is passive: monitor for 802.15.4 traffic on the target PAN, or scan channels for beaconing nodes. No credentials, association, or key exchange is required at any stage.

2. Triggering the flaw. Craft an 802.15.4 data frame with a payload shorter than the configured authentication tag length — the description confirms a frame with a one-byte payload is accepted by ieee802154_validate_frame(). Transmit it toward the target. This forces net_pkt_get_len(pkt) - ll_hdr_len - authtag_len to underflow in uint8_t arithmetic inside ieee802154_decipher_data_frame(), yielding a wrapped payload_len up to 255.

3. Execution / payload method. No payload construction is needed in the traditional sense: the malformed length is the weapon. The wrapped payload_len flows to ieee802154_decrypt_auth() and the CCM operation as cipher_pkt.in_len / out_buf_max, with apkt->tag set to frame + ll_hdr_len + payload_len. The crypto layer then reads and writes roughly 240 bytes past the end of the exactly-sized receive buffer. The authentication tag is checked only afterwards, so the frame is never rejected before the memory access occurs.

4. Post-exploitation impact. The out-of-bounds read/write lands in the adjacent network-buffer pool, corrupting other packets or allocator metadata and typically faulting the target. The written bytes are not attacker-controlled (they derive from ciphertext XOR keystream over adjacent memory), so the realistic outcomes are packet corruption, heap/allocator metadata damage, and device crash/reset — availability impact — with the possibility of further undefined behavior depending on what adjacent memory is corrupted. Repeated transmission sustains a denial-of-service condition.

Impact Assessment

CVSS 3.1 base score: 8.1 (High) — CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H.

• AV:A (Adjacent): Attack is mounted over the 802.15.4 radio link from a device in range; no internet exposure is required, which is typical of wireless link-layer flaws.
• AC:L (Low): The described defect requires only a short frame; no race condition, timing precision, or complex setup is indicated.
• PR:N / UI:N: No privileges and no user interaction — the frame is processed by the network stack without association or authentication, as the tag check occurs after the vulnerable operation.
• C:N: Confidentiality is not scored as impacted; the out-of-bounds read content is not described as reliably disclosable to the attacker.
• I:H: Out-of-bounds write into the network-buffer pool corrupts adjacent packets and allocator metadata — a high integrity impact on those structures.
• A:H: The device typically faults, producing a reset/DoS.

Blast radius: Any Zephyr 802.15.4 node in radio range of the attacker. In mesh/Thread-style deployments, a single compromised or malicious node can repeatedly target neighbors, degrading or destabilizing the PAN. Because the primitive is unauthenticated and pre-authentication, it also constitutes a low-barrier denial-of-service vector against battery- or safety-critical endpoints. No affected-version list or fixed release is available, so scoping must proceed by inventory (see Mitigation). EPSS has not been scored by FIRST.org; no exploitation evidence or KEV listing exists.

Detection Guidance

Sigma Rule

title: Zephyr 802.15.4 Short-Frame Underflow Attempt (CVE-2026-19186)
id: 3f6c1a2e-8b4d-4e6f-9a1c-2d7b5e0c9a41
status: experimental
description: Detects host-side indications of the ieee802154_decipher_data_frame() uint8_t payload_len underflow, where an abnormally large decrypt length is derived from a short received 802.15.4 frame.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-19186
author: valtersit.com
date: 2026-07-13
logsource:
  product: linux
  service: kernel
detection:
  keywords:
    - "ieee802154_decipher_data_frame"
    - "ieee802154_decrypt_auth"
    - "payload_len"
    - "out_buf_max"
    - "net_buf overflow"
  condition: keywords
falsepositives:
  - Legitimate 802.15.4 diagnostics and fuzzing
level: high

YARA Rule

rule CVE_2026_19186_Zephyr_IEEE802154_Underflow
{
    meta:
        description = "Detects Zephyr 802.15.4 frame decipher underflow code pattern (CVE-2026-19186)"
        author = "valtersit.com"
        date = "2026-07-13"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-19186"
        hash_hint = "subsys/net/l2/ieee802154/ieee802154_frame.c"
    strings:
        $fn  = "ieee802154_decipher_data_frame" ascii
        $dec = "ieee802154_decrypt_auth" ascii
        $tag = "authtag_len" ascii
        $len = "payload_len" ascii
    condition:
        filesize < 5MB and $fn and $dec and $tag and $len
}

Suricata IDS Rule

alert udp any any -> any any (msg:"CVE-2026-19186 Zephyr 802.15.4 undersized frame length underflow attempt"; flow:stateless; dsize:<4; reference:cve,2026-19186; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-19186; classtype:attempted-dos; sid:202619186; rev:1;)

Elastic Detection

process where event.type == "start" and process.name == "ieee802154_decipher_data_frame"

(Note: Zephyr targets are MCU/RTOS firmware; direct EQL coverage requires UART/RTT log forwarding or host-side gateway telemetry rather than Endpoint process events. Treat the above as a placeholder pattern where firmware logs are ingested as processes; the reliable detection surface is the network-packet rule and the Wazuh log rule below.)

Splunk SPL Query

index=embedded OR index=network sourcetype=zephyr_802154_log
| search ("ieee802154_decipher_data_frame" OR "ieee802154_decrypt_auth")
        AND ("payload_len" OR "underflow" OR "out_buf_max")
| stats count min(_time) as first_seen max(_time) as last_seen by host, src, message
| where count >= 1
| sort - count

Wazuh OSSEC Rule

<group name="zephyr,802154,cve-2026-19186,">
  <rule id="100286" level="12">
    <decoded_as>syslog</decoded_as>
    <match>ieee802154_decipher_data_frame|ieee802154_decrypt_auth|payload_len underflow</match>
    <description>CVE-2026-19186: Zephyr 802.15.4 frame decipher length underflow detected</description>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). There is no vendor fix, no workaround, and no affected/fixed version data available.

1) Immediate mitigations (device/firmware level):

• Add a bounds check before the subtraction so that payload_len is only computed when net_pkt_get_len(pkt) >= ll_hdr_len + authtag_len; reject (drop) frames that fail the check. If source modification is not possible, disable the 802.15.4 link layer (subsys/net/l2/ieee802154/) on any node that does not strictly require it.
• Where the stack is built from source, move authentication-tag verification ahead of any decrypt/copy operation so malformed short frames are discarded before the CCM call processes the derived length.
• Harden frame validation in ieee802154_validate_frame() to reject data frames whose payload is shorter than the configured authentication tag length.
• Isolate radio ranges operationally: for non-production / test nodes, reduce RF exposure or segregate 802.15.4 PANs to limit attacker adjacency.

2) Patch / upgrade steps:

• No patch is currently available. Monitor the Zephyr project security advisories and NVD for CVE-2026-19186 updates and a fixed release/commit. Do not assume a fixed version exists; verify against the vendor channel before deploying.
• Because no CVSS-affecting details outside the CVE record are available, treat vendor advisories as the authoritative trigger. When an update ships, prioritize nodes reachable by any radio neighbor.

3) Long-term hardening:

• Adopt a memory-safe framing discipline in the 802.15.4 receive path: compute lengths using wider integer types (e.g., size_t/checked arithmetic) and validate all derived lengths against the received buffer length before use.
• Add fuzzing and negative testing for short/malformed frames in CI for the 802.15.4 L2 module.
• Enforce pre-authentication input validation across the network stack — never perform cryptographic processing (CCM decrypt, buffer copy) on data whose authentication tag has not yet been verified.
• Maintain an inventory of Zephyr-based 802.15.4/Thread devices so radio-reachable exposure is known and can be patched quickly. Monitor CISA KEV for any future addition of this CVE.

References

• NVD — CVE-2026-19186: https://nvd.nist.gov/vuln/detail/CVE-2026-19186
• CWE-191 (Integer Underflow / Wrap-around): https://cwe.mit.edu/data/definitions/191.html
• Zephyr Project security advisories: https://github.com/zephyrproject-rtos/zephyr/security
• Zephyr RTOS source — 802.15.4 frame handling: subsys/net/l2/ieee802154/ieee802154_frame.c
• MITRE ATT&CK — T1190 (Exploit Public-Facing Application; adjacent-network analogue): https://attack.mitre.org/techniques/T1190/

Exploit-in-the-wild / campaign evidence: None. No PoC, no exploit code, no Nuclei template, and no CISA KEV listing exists for CVE-2026-19186. EPSS has not been scored by FIRST.org.