Out-of-Bounds Read Vulnerability in Zephyr's GPTP Implementation

CVE-2026-16514

What is CVE-2026-16514?

A vulnerability exists in the gptp_mi_qualify_announce() function of Zephyr RTOS that allows an unauthenticated attacker on the same Ethernet segment to exploit the Path Trace TLV of an IEEE 802.1AS Announce message. The attacker can manipulate the announce->steps_removed field, which leads to an out-of-bounds read beyond the end of the received frame. This issue arises due to insufficient bounds checking in the implementation, resulting in the potential for the networking RX thread to fault and cause a denial of service. This risk is particularly relevant for experimental CONFIG_NET_GPTP builds. A fix has been introduced to properly validate the entry count based on the tlv.len field to prevent such exploitation.

References