Memory Corruption Vulnerability in Zephyr Project Ethernet Protocol

CVE-2026-82962

What is CVE-2026-82962?

In the Zephyr Project's Ethernet Protocol, a vulnerability exists where the ethernet_fill_header() function can incorrectly prepend an Ethernet header in place, utilizing headroom from packets that lack sufficient buffer allocation. If packets are moved from other layers, and their headroom is insufficient, it may lead to overwriting adjacent memory, resulting in memory corruption. This issue could cause crashes or erratic packet behavior when processing network traffic, particularly under configurations involving routing and tunneling. A fix has been implemented to ensure that the in-place header insertion only occurs when there is adequate headroom available, preventing this potential compromise.

References