Bitwise Shift Vulnerability in Zephyr's PTP Subsystem

CVE-2026-5072

What is CVE-2026-5072?

A vulnerability in Zephyr's Precision Time Protocol (PTP) subsystem allows remote attackers to exploit a bitwise shift error. By sending a specially crafted PTP_MSG_MANAGEMENT message with an unvalidated negative log_announce_interval value, attackers can provoke undefined behavior. This occurs during the processing of a PTP_MSG_ANNOUNCE message when the port_timer_set_timeout_random function attempts to compute a timeout based on the negative log_seconds value. If the value is excessively negative, it leads to shifts exceeding the 64-bit integer capacity, resulting in undefined behavior, potential system crashes, or logical errors due to erroneous timeout computations. This vulnerability illustrates significant risks, enabling resource starvation or incorrect operational logic in affected systems.

References