gPTP Vulnerability in Zephyr Project Affects Multiple Ethernet Implementations

CVE-2026-16512

What is CVE-2026-16512?

A vulnerability in the gPTP implementation within the Zephyr RTOS allows an unauthenticated peer to exploit the system by sending malformed Ethernet frames. This occurs when a gPTP header is processed without verifying the received frame's payload length, permitting out-of-bounds memory access. Attackers can leverage this exploit via specific interfaces configured as gPTP ports, resulting in potential data leakage from stale memory. The vulnerability remains prevalent in scenarios where Ethernet frames can be filled below the expected minimum length, particularly when utilizing specific drivers or configurations.

References