Vulnerability in IEEE 1588 PTP Implementation of Zephyr RTOS

CVE-2026-87042

What is CVE-2026-87042?

The IEEE 1588 (PTP) implementation in Zephyr RTOS is vulnerable due to improper validation of the logMessageInterval field in received Delay_Resp messages. This flaw allows an attacker on the same network segment to send crafted messages, causing the PTP subsystem to enter an infinite loop of Delay_Req broadcasts, thereby exhausting network resources and impacting time synchronization. This issue arises from the system's reliance on unauthenticated multicast traffic and the acceptance of arbitrary Delay_Resp messages, which can be exploited to either stall PTP operations or create a multicast flood that consumes CPU resources. Mitigation is available through specific validation checks that restrict the accepted interval values.

References