CVE-2026-10664: memory-safety in zephyrproject zephyr
The nRF70 Wi-Fi driver's power-save event handler nrf_wifi_event_proc_get_power_save_info() in drivers/wifi/nrf_wifi/src/wifi_mgmt.c copied TWT (Target Wake Time) flow entries from an nrf_wifi_umac_event_power_save_info event into the fixed-size twt_flows[WIFI_MAX_TWT_FLOWS] (8-element) array of a caller-supplied struct wifi_ps_config, looping over event-provided num_twt_flows without validating it against WIFI_MAX_TWT_FLOWS or checking event_len. When num_twt_flows exceeds 8, the handler writes past the destination array (which is typically on the caller's stack, e.g. the wifi ps shell command) -- an out-of-bounds write of ~40-byte TWT entries -- and reads twt_flow_info[i] past the event buffer. The event is delivered by the nRF70 co-processor firmware in response to a host-initiated power-save GET, so reaching the overflow requires the firmware to emit a malformed or out-of-range event; the trust boundary is host-to-trusted-coprocessor rather than a direct remote-AP write, with over-the-air influence on the flow count being indirect and bounded by the 3-bit TWT flow-id space. Affected: builds with CONFIG_NRF70_STA_MODE on releases through v4.4.0. The fix rejects events with num_twt_flows > WIFI_MAX_TWT_FLOWS or with event_len shorter than the claimed entries, and adds a NULL check on the caller buffer.
AI Analysis
Technical Summary
The nRF70 Wi-Fi driver's power-save event handler function nrf_wifi_event_proc_get_power_save_info() copies TWT flow entries from an event into a fixed-size array without validating the number of flows against the array size or the event length. When the number of TWT flows exceeds the maximum of 8, this results in an out-of-bounds write of approximately 40 bytes and out-of-bounds reads beyond the event buffer. The event originates from the nRF70 co-processor firmware in response to a host-initiated power-save GET request. Exploitation requires the firmware to emit a malformed event, with the trust boundary between host and trusted co-processor. The vulnerability affects Zephyr versions 4.4.0 and all versions from 4.4.0 up to but not including 4.5.0 built with CONFIG_NRF70_STA_MODE. The patch rejects events with num_twt_flows greater than WIFI_MAX_TWT_FLOWS or with event length shorter than claimed, and adds a null check on the caller buffer.
Potential Impact
This vulnerability can lead to out-of-bounds memory writes and reads in the Wi-Fi driver's power-save event handler, potentially causing memory corruption, instability, or denial of service. The impact is limited by the trust boundary being between the host and the trusted nRF70 co-processor firmware, requiring the firmware to send malformed events. There is no indication of remote exploitation directly from an external attacker without firmware compromise. The CVSS score of 5.0 reflects a medium severity with low confidentiality, integrity, and availability impacts under the given attack vector and complexity.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The described fix rejects events with num_twt_flows exceeding the maximum allowed and verifies event length, as well as adding a null check on the caller buffer. Users should monitor the Zephyr project advisories for an official fix or update. Until then, mitigating the risk involves ensuring that only trusted firmware is used and that the CONFIG_NRF70_STA_MODE is enabled only when necessary.
CVE-2026-10664: memory-safety in zephyrproject zephyr
Description
The nRF70 Wi-Fi driver's power-save event handler nrf_wifi_event_proc_get_power_save_info() in drivers/wifi/nrf_wifi/src/wifi_mgmt.c copied TWT (Target Wake Time) flow entries from an nrf_wifi_umac_event_power_save_info event into the fixed-size twt_flows[WIFI_MAX_TWT_FLOWS] (8-element) array of a caller-supplied struct wifi_ps_config, looping over event-provided num_twt_flows without validating it against WIFI_MAX_TWT_FLOWS or checking event_len. When num_twt_flows exceeds 8, the handler writes past the destination array (which is typically on the caller's stack, e.g. the wifi ps shell command) -- an out-of-bounds write of ~40-byte TWT entries -- and reads twt_flow_info[i] past the event buffer. The event is delivered by the nRF70 co-processor firmware in response to a host-initiated power-save GET, so reaching the overflow requires the firmware to emit a malformed or out-of-range event; the trust boundary is host-to-trusted-coprocessor rather than a direct remote-AP write, with over-the-air influence on the flow count being indirect and bounded by the 3-bit TWT flow-id space. Affected: builds with CONFIG_NRF70_STA_MODE on releases through v4.4.0. The fix rejects events with num_twt_flows > WIFI_MAX_TWT_FLOWS or with event_len shorter than the claimed entries, and adds a NULL check on the caller buffer.
CVSS v3.1
Score 5.0medium
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The nRF70 Wi-Fi driver's power-save event handler function nrf_wifi_event_proc_get_power_save_info() copies TWT flow entries from an event into a fixed-size array without validating the number of flows against the array size or the event length. When the number of TWT flows exceeds the maximum of 8, this results in an out-of-bounds write of approximately 40 bytes and out-of-bounds reads beyond the event buffer. The event originates from the nRF70 co-processor firmware in response to a host-initiated power-save GET request. Exploitation requires the firmware to emit a malformed event, with the trust boundary between host and trusted co-processor. The vulnerability affects Zephyr versions 4.4.0 and all versions from 4.4.0 up to but not including 4.5.0 built with CONFIG_NRF70_STA_MODE. The patch rejects events with num_twt_flows greater than WIFI_MAX_TWT_FLOWS or with event length shorter than claimed, and adds a null check on the caller buffer.
Potential Impact
This vulnerability can lead to out-of-bounds memory writes and reads in the Wi-Fi driver's power-save event handler, potentially causing memory corruption, instability, or denial of service. The impact is limited by the trust boundary being between the host and the trusted nRF70 co-processor firmware, requiring the firmware to send malformed events. There is no indication of remote exploitation directly from an external attacker without firmware compromise. The CVSS score of 5.0 reflects a medium severity with low confidentiality, integrity, and availability impacts under the given attack vector and complexity.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The described fix rejects events with num_twt_flows exceeding the maximum allowed and verifies event length, as well as adding a null check on the caller buffer. Users should monitor the Zephyr project advisories for an official fix or update. Until then, mitigating the risk involves ensuring that only trusted firmware is used and that the CONFIG_NRF70_STA_MODE is enabled only when necessary.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- zephyr
- Date Reserved
- 2026-06-02T15:25:25.070Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a54991068715ace436e94d8
Added to database: 07/13/2026, 07:51:44 UTC
Last enriched: 07/13/2026, 07:52:55 UTC
Last updated: 07/14/2026, 00:11:59 UTC
Views: 10
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.