CVE-2026-87042: Zephyr PTP port unvalidated logMessageInterval denial of service

CVE-2026-87042 · Severity: medium · CVSS 6.5 · Published 2026-11-10

Zephyr's PTP (Precision Time Protocol) implementation in the network subsystem does not validate timing parameters received in PTP messages from the network. An attacker on the same network link can send a crafted PTP message with an invalid timing value, causing the PTP subsystem to malfunction and stop providing time synchronization until the device is rebooted. This disrupts timekeeping for applications that depend on synchronized time.

Technologies: Zephyr Project Zephyr. Vendors: Zephyr Project.

Quick answers

Is CVE-2026-87042 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-87042 being exploited in the wild.
How severe is CVE-2026-87042?
Medium severity, with a CVSS score of 6.5, published 10 November 2026.
Which products and versions are affected?
Zephyr Project Zephyr versions prior to the fix.
Is there a fix for CVE-2026-87042?
Yes: fixed in Fixed by validation of logMessageInterval range and treatment of 0x7F as "not applicable" per IEEE 1588-2019. Until then: Restrict PTP traffic (UDP port 319/320 or raw IEEE 802.3 Type 0x88F7 on multicast addresses 224.0.1.129 and FF02::181) to trusted network segments using network segmentation or firewall rules if PTP is not required on the affected link. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-87042 attacked?
It is attacked over the network, in an operating system.
Am I affected by CVE-2026-87042?
Check whether you run Zephyr Project Zephyr at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Fixed in: Fixed by validation of logMessageInterval range and treatment of 0x7F as "not applicable" per IEEE 1588-2019

Restrict PTP traffic (UDP port 319/320 or raw IEEE 802.3 Type 0x88F7 on multicast addresses 224.0.1.129 and FF02::181) to trusted network segments using network segmentation or firewall rules if PTP is not required on the affected link.

Technical details

The PTP port implementation in subsys/net/lib/ptp/port.c fails to validate the logMessageInterval field from received Delay_Resp and Sync messages, storing raw int8_t values that are later used as bit-shift operands. Shift counts outside the representable range (below -30 or ≥64) cause either a zero timeout or undefined behavior; the standard "not applicable" encoding 0x7F triggers undefined shifts. An unauthenticated attacker on the local link can inject a single crafted Delay_Resp message, triggering either a message buffer exhaustion deadlock or a sustained multicast flood, permanently denying PTP service without memory corruption or data disclosure.

Affected products

  • Zephyr Project Zephyr versions prior to the fix

Timeline

  • 2026-11-10: disclosed

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.