VLAN Processing Vulnerability in Zephyr RTOS Ethernet Stack

CVE-2026-19673

What is CVE-2026-19673?

The Ethernet stack in Zephyr RTOS has a vulnerability due to inadequate validation of VLAN tagged frames. The issue arises when a crafted Ethernet frame of certain lengths leads to a reinterpretation of buffer data, allowing attackers to trigger a denial of service condition. This occurs because the length of the frame is not properly verified when handling VLAN tags, which can result in an out-of-bounds memory access and potential information disclosure. The vulnerability affects configurations with VLAN enabled and requires no specific knowledge of the VLAN setup, making it exploitable in various network environments. A patch has been issued to enhance validation checks on frame lengths before processing the data.

References