CVE-2026-5072 Details
Description
A bitwise shift vulnerability in Zephyr's PTP subsystem allows a remote attacker to cause undefined behavior and potential system crashes. An attacker sends a crafted PTP_MSG_MANAGEMENT message to set an unvalidated negative log_announce_interval value in the port's data set. When a subsequent PTP_MSG_ANNOUNCE message is processed, port_timer_set_timeout_random computes a timeout as NSEC_PER_SEC >> -log_seconds; if the attacker-supplied value is sufficiently negative (e.g., -127), the shift amount exceeds the 64-bit integer width, triggering undefined behavior in C. This can cause a system crash via a compiler-generated illegal instruction trap on some architectures, or produce an erroneous zero timeout leading to resource starvation loops or other logical errors.
A bitwise shift vulnerability has been identified in the Precision Time Protocol (PTP) subsystem of Zephyr, in versions through 4.3. This vulnerability allows remote attackers to cause undefined behavior and potentially crash the system. The issue arises when an attacker sends a crafted PTP_MSG_MANAGEMENT message that includes an unvalidated negative log_announce_interval value. This value is then used in a bitwise shift operation, where a sufficiently negative value can exceed the limits of a 64-bit integer, leading to undefined behavior in C. Such exploitation can cause a system crash on certain architectures or create logical errors by disrupting normal processing.
The recommended fix is to validate the log_announce_interval and log_min_delay_req_interval values against the PTP specification limits upon receipt in the port_delay_resp_msg_process function.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 22, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-3v98-458v-388r | [email protected] | ExploitPatchVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-1335 | Incorrect Bitwise Shift of Integer | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| zephyrproject zephyr | <= 4.3.0 |
CPE
Remediation
| |
Change History
8 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 23, 2026 | CVE Translated | [email protected] |
| Jul 8, 2026 | Initial Analysis | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 26, 2026 | CVE Modified | CISA-ADP |
| May 26, 2026 | CVE Modified | CISA-ADP |
| May 22, 2026 | CVE Modified | CISA-ADP |
| May 22, 2026 | New CVE Received | [email protected] |