CVE-2026-10664: Zephyr nRF70 Wi-Fi Buffer Overflow Issue

CVE-2026-10664 Overview

CVE-2026-10664 is an out-of-bounds write vulnerability [CWE-787] in the Zephyr RTOS nRF70 Wi-Fi driver. The flaw resides in nrf_wifi_event_proc_get_power_save_info() within drivers/wifi/nrf_wifi/src/wifi_mgmt.c. The handler copies Target Wake Time (TWT) flow entries from an nrf_wifi_umac_event_power_save_info event into a fixed-size 8-element array (twt_flows[WIFI_MAX_TWT_FLOWS]) inside a caller-supplied struct wifi_ps_config. The code loops over the event-provided num_twt_flows field without validating it against WIFI_MAX_TWT_FLOWS or checking event_len. Builds using CONFIG_NRF70_STA_MODE through Zephyr v4.4.0 are affected.

Critical Impact
A malformed or out-of-range event from the nRF70 co-processor firmware triggers an out-of-bounds stack write of roughly 40-byte TWT entries in the caller's buffer, plus an out-of-bounds read past the event buffer.

Affected Products

Zephyr RTOS releases through v4.4.0
Builds compiled with CONFIG_NRF70_STA_MODE
Applications using the nRF70 Wi-Fi driver power-save GET path (e.g., the wifi ps shell command)

Discovery Timeline

2026-07-12 - CVE-2026-10664 published to NVD
2026-07-16 - Last updated in NVD database

Technical Details for CVE-2026-10664

Vulnerability Analysis

The defect is a classic missing bounds check in an event-parsing path. The handler nrf_wifi_event_proc_get_power_save_info() receives an nrf_wifi_umac_event_power_save_info event and iterates over num_twt_flows while copying twt_flow_info[i] entries into the caller's twt_flows[] array. Because WIFI_MAX_TWT_FLOWS equals 8 and no check enforces that ceiling, values exceeding 8 cause writes past the destination array. The destination typically lives on the caller's stack, meaning corruption reaches return addresses, saved registers, and adjacent locals. The same loop reads twt_flow_info[i] from the event buffer without validating event_len, producing an out-of-bounds read of neighboring memory.

Root Cause

The root cause is untrusted length handling. The driver trusts a field controlled by the nRF70 co-processor firmware and uses it as a loop bound against a fixed-size destination. There is no length reconciliation between num_twt_flows, event_len, and WIFI_MAX_TWT_FLOWS, and no NULL check on the caller-supplied wifi_ps_config buffer.

Attack Vector

Exploitation requires the co-processor firmware to emit a malformed event in response to a host-initiated power-save GET. The trust boundary is host-to-trusted-coprocessor rather than direct remote-AP-to-host. Over-the-air influence on the TWT flow count is indirect and bounded by the 3-bit TWT flow-id space, which limits the practical write beyond the 8-entry array. An adjacent-network attacker with the ability to influence firmware behavior could steer the count into an out-of-range value.

// Patched file: drivers/wifi/nrf_wifi/src/wifi_mgmt.c
// drivers: wifi: nrf_wifi: Validate PS event TWT flow count and length

#include <stddef.h>
#include <stdlib.h>

#include <zephyr/kernel.h>
// The fix rejects events with num_twt_flows > WIFI_MAX_TWT_FLOWS
// or event_len shorter than the claimed entries, and adds a NULL
// check on the caller-supplied wifi_ps_config buffer.

Source: Zephyr commit a2c4324acd50a5f92e492e6e460e6297af826148

Detection Methods for CVE-2026-10664

Indicators of Compromise

Unexpected crashes, stack-canary faults, or hard faults in tasks invoking wifi ps shell commands or power-save queries on nRF70 targets.
Diagnostic logs showing nrf_wifi_umac_event_power_save_info events with num_twt_flows values greater than 8.
Firmware images or co-processor binaries whose provenance cannot be verified against vendor release hashes.

Detection Strategies

Audit build configurations for CONFIG_NRF70_STA_MODE and check the Zephyr version against the v4.4.0 fix threshold.
Add runtime instrumentation or asserts around nrf_wifi_event_proc_get_power_save_info() to log num_twt_flows and event_len for anomalous values.
Review inventory data for embedded devices running Zephyr with the nRF70 driver enabled.

Monitoring Recommendations

Correlate device reboot and crash telemetry with Wi-Fi power-save operations to surface potential exploitation attempts.
Track vendor advisories from the Zephyr Project and Nordic Semiconductor for nRF70 firmware updates.
Where devices report to a backend, monitor for repeated fault signatures originating in the Wi-Fi management path.

How to Mitigate CVE-2026-10664

Immediate Actions Required

Upgrade Zephyr to a release containing commit a2c4324acd50a5f92e492e6e460e6297af826148 and rebuild firmware for all affected devices.
If upgrade is not immediately feasible, disable or gate the wifi ps shell command and any application code path calling nrf_wifi_event_proc_get_power_save_info().
Validate that co-processor firmware images shipped with the device match trusted vendor artifacts.

Patch Information

The fix is available in Zephyr upstream via commit a2c4324acd50a5f92e492e6e460e6297af826148. It rejects events with num_twt_flows > WIFI_MAX_TWT_FLOWS, rejects events whose event_len is shorter than the claimed entries, and adds a NULL check on the caller-supplied buffer. See the GitHub Security Advisory GHSA-3r6j-pm38-r43m for the full advisory.

Workarounds

Build without CONFIG_NRF70_STA_MODE where station mode is not required.
Remove exposure of the wifi ps shell command in production images.
Restrict physical and wireless access to devices while patches are staged.

bash

# Verify Zephyr version and patch presence
cd zephyr
git log --oneline | grep a2c4324acd50a5f92e492e6e460e6297af826148

# Rebuild firmware after applying the fix
west update
west build -b <nrf70_board> -p always samples/net/wifi