CVE-2026-10665: Zephyr WireGuard DOS Vulnerability

CVE-2026-10665 Overview

CVE-2026-10665 is an out-of-bounds write vulnerability [CWE-787] in the WireGuard subsystem of the Zephyr real-time operating system. The flaw resides in wg_process_data_message() within subsys/net/lib/wireguard/wg_crypto.c. The function linearizes an inbound transport-data payload into a fixed pool buffer of CONFIG_WIREGUARD_BUF_LEN bytes before decryption. It passes the attacker-derived data_len as both the destination capacity and the copy length to net_buf_linearize(), defeating the internal bound. The overflow occurs prior to Poly1305 authentication, so an attacker needs only a valid receiver session index, not a valid authenticator.

Critical Impact
Remote memory corruption reachable over the network by a malicious peer, compromised peer, or on-path attacker against an established WireGuard session, resulting in at minimum a reliable denial of service.

Affected Products

Zephyr 4.4.0-rc1
Zephyr 4.4.0-rc2
Zephyr 4.4.0-rc3

Discovery Timeline

2026-07-12 - CVE-2026-10665 published to NVD
2026-07-16 - Last updated in NVD database

Technical Details for CVE-2026-10665

Vulnerability Analysis

The defect exists in Zephyr's WireGuard receive path. wg_process_data_message() calls net_buf_linearize(buf->data, data_len, pkt->buffer, ..., data_len) to consolidate the encrypted payload into a contiguous pool buffer sized by CONFIG_WIREGUARD_BUF_LEN. Passing data_len as both the destination capacity and the copy length nullifies the len = min(len, dst_len) guard inside the helper. The underlying memcpy then writes past the end of the fixed pool buffer whenever data_len exceeds CONFIG_WIREGUARD_BUF_LEN.

Because corruption occurs before the Poly1305 authentication check, the attacker does not need to forge a valid authenticator. A valid receiver session index is sufficient, which is reachable by any peer sharing an established session or by an on-path attacker replaying and driving traffic into that session. The consequence is remote heap-adjacent memory corruption in the network buffer pool and a reliable denial-of-service condition against the target device.

Root Cause

The root cause is misuse of the net_buf_linearize() API. The function accepts separate dst_len and len parameters to allow the caller to enforce a hard destination bound. The Zephyr WireGuard code supplied the attacker-influenced data_len for both arguments. data_len derives from the received UDP datagram length and is only lower-bounded by wg_ctrl_recv(); no upper bound is enforced before linearization.

Attack Vector

The overflow triggers when data_len exceeds CONFIG_WIREGUARD_BUF_LEN. This occurs when the buffer length is configured below the link MTU, on links whose MTU is larger than the buffer size, or when reassembled IPv4 or IPv6 fragments exceed the buffer. An attacker able to send UDP traffic to the WireGuard listener with a valid receiver session index can drive oversized transport-data frames into the vulnerable path. Exploitation requires an established session context, which contributes to the high attack complexity but not to privilege or user-interaction requirements.

See the GitHub Security Advisory GHSA-3wqm-wgx2-9367 and the upstream fix commit for the exact code paths.

Detection Methods for CVE-2026-10665

Indicators of Compromise

Unexpected crashes, kernel faults, or watchdog resets on Zephyr devices running WireGuard shortly after receiving UDP traffic on the WireGuard listener port.
Corruption of adjacent objects in the net_buf pool, observable as malformed subsequent packets or asserts in net_buf accounting.
Inbound WireGuard transport-data datagrams whose payload length exceeds the configured CONFIG_WIREGUARD_BUF_LEN on the device.

Detection Strategies

Inspect firmware builds for CONFIG_WIREGUARD_BUF_LEN values lower than the effective link MTU or IP reassembly maximum, which expands the exploitable window.
Enable Zephyr fault handlers, stack sentinels, and CONFIG_NET_BUF_POOL_USAGE diagnostics to catch pool-buffer corruption and abnormal termination on the receive path.
Monitor network telemetry for oversized UDP datagrams or fragmented IPv4/IPv6 traffic directed at WireGuard endpoints on embedded devices.

Monitoring Recommendations

Log and alert on repeated device reboots correlated with WireGuard peer activity, particularly from newly added or rotating peers.
Capture packet traces at the network perimeter for WireGuard UDP flows to identify anomalous payload sizes crossing MTU or reassembly thresholds.
Track firmware inventory to confirm which fielded devices run Zephyr 4.4.0 release candidates with WireGuard enabled.

How to Mitigate CVE-2026-10665

Immediate Actions Required

Upgrade Zephyr-based firmware to a build that includes commit 6d8bb28dc9064e05e52b5a00b2998ecc663e38cb, which rejects data_len > CONFIG_WIREGUARD_BUF_LEN and passes net_buf_max_len(buf) as the destination capacity.
Inventory all devices running Zephyr 4.4.0-rc1, rc2, or rc3 with the WireGuard subsystem enabled and prioritize their remediation.
Restrict WireGuard peer configurations to trusted endpoints only and rotate pre-shared keys after patching.

Patch Information

The upstream fix is available in the Zephyr project via commit 6d8bb28dc9064e05e52b5a00b2998ecc663e38cb. The patch adds an explicit data_len > CONFIG_WIREGUARD_BUF_LEN rejection in wg_process_data_message() and corrects the net_buf_linearize() call to pass net_buf_max_len(buf) as the destination capacity. Further guidance is documented in GitHub Security Advisory GHSA-3wqm-wgx2-9367.

Workarounds

Raise CONFIG_WIREGUARD_BUF_LEN above the maximum IPv4/IPv6 reassembly size the device will accept, eliminating the size mismatch that triggers the overflow.
Disable IPv4 and IPv6 fragmentation reassembly on the WireGuard interface where feasible, or lower the accepted MTU so inbound datagrams cannot exceed the buffer.
Filter WireGuard UDP listener ports at an upstream firewall to allow traffic only from known peer addresses until firmware is updated.

bash

# Example: build Zephyr with a WireGuard buffer sized above the link MTU
# in your project's prj.conf
CONFIG_WIREGUARD=y
CONFIG_WIREGUARD_BUF_LEN=2048
CONFIG_NET_BUF_POOL_USAGE=y
CONFIG_NET_IPV4_FRAGMENT=n
CONFIG_NET_IPV6_FRAGMENT=n