CVE-2026-13734: auth in zephyrproject zephyr

The vulnerability exists in the WireGuard VPN data-plane receive handler wg_process_data_message() in Zephyr's network subsystem. After successful AEAD decryption of a MESSAGE_TRANSPORT_DATA packet, several peer-state changes are committed before the replay check wg_check_replay() is performed. If a replayed packet is detected, the replay check returns an error but does not roll back the prior state mutations. This allows an attacker who can capture a valid ciphertext to re-inject it from a spoofed source address, causing the victim's peer endpoint to be redirected (roaming hijack), prematurely destroying the previous keypair and refreshing liveness timers. The payload remains encrypted, so the impact is on traffic redirection and session disruption rather than confidentiality. The fix involves moving the replay check immediately after decryption and before any state changes, aligning with the WireGuard specification and Linux reference implementation.

An attacker capable of capturing a valid encrypted WireGuard packet can replay it from an arbitrary spoofed source address without credentials. This causes the victim's WireGuard peer endpoint to be redirected to the attacker-chosen address, disrupting the tunnel session and prematurely destroying cryptographic keypairs. The payload confidentiality is not affected, but the integrity and availability of the VPN tunnel are compromised, potentially redirecting traffic and causing session disruption until corrected by legitimate packets.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The vulnerability fix involves reordering the replay check to occur immediately after decryption and before any peer-state mutations. Until an official fix is released, monitor vendor communications for updates. No generic mitigations are specifically recommended by the vendor advisory.