CVE-2026-17054: Espressif ESP-hosted Wi-Fi Driver DOS

CVE-2026-17054 Overview

CVE-2026-17054 is an out-of-bounds read vulnerability [CWE-125] in the Zephyr RTOS ESP-hosted Wi-Fi driver at drivers/wifi/esp_hosted/. The driver parses control frames received over SPI from an ESP co-processor inside esp_hosted_event_task(). It accepts a 16-bit TLV data_length field directly from the wire and passes it to pb_istream_from_buffer() without bounds validation. An adjacent, unauthenticated attacker within Wi-Fi range can influence the content of legitimate control responses, such as the AP scan list, to trigger the fault.

Critical Impact
Successful exploitation causes a permanent denial of service. The affected device halts all Wi-Fi reception until it is rebooted, and the driver has no watchdog or restart path.

Affected Products

Zephyr RTOS ESP-hosted Wi-Fi driver (drivers/wifi/esp_hosted/)
Devices integrating a Zephyr host with an Espressif ESP co-processor over SPI
Configurations with CONFIG_NANOPB_ENABLE_MALLOC enabled

Discovery Timeline

2026-09-21 - CVE-2026-17054 published to NVD
2026-09-22 - Last updated in NVD database

Technical Details for CVE-2026-17054

Vulnerability Analysis

The defect resides in the control-frame parser of esp_hosted_event_task(). The frame.data_value buffer sits 26 bytes into a 3188-byte stack object. A data_length value up to 0xFFFF allows pb_decode() to read roughly 62 KB past the end of that stack region. Reading past the RAM boundary faults the device. Because CONFIG_NANOPB_ENABLE_MALLOC is selected, garbage length prefixes read out of bounds can also drive heap allocations.

The impact is limited to denial of service, not information disclosure. pb_decode() starts mid-stream on raw protobuf continuation bytes and almost always fails outright. Any successfully decoded structure must still pass esp_hosted_response(), which enforces an exact msg_id match, and esp_hosted_ctrl_response(), which requires a success response.

Root Cause

The pre-patch driver performed half-duplex SPI transactions. esp_hosted_hal_spi_transfer() aliased the RX buffer onto the TX buffer, silently discarding any frame the co-processor queued while the host was transmitting. When the discarded frame was the first fragment of a fragmented control response, the driver treated the next fragment as a new frame. Its per-fragment header and checksum were genuine and passed validation, but the TLV header was then read out of raw protobuf continuation bytes.

Two related defects make the denial of service permanent. The fragment reassembly guard was sized with ESP_FRAME_SIZE instead of ESP_FRAME_MAX_PAYLOAD and, when tripped, returned from the sole RX thread instead of dropping the frame. Unhandled control events were queued with k_msgq_put(..., K_FOREVER) on an eight-entry queue that nothing drains, blocking that same thread.

Attack Vector

An adjacent attacker within radio range shapes the size and content of legitimate control responses, notably the AP scan list. The scan list grows with the number and SSID length of nearby access points, which the attacker controls by broadcasting crafted beacon frames. When the response fragments in a way that races the host TX path, the misaligned TLV parse triggers the fault.

// Patch excerpt: drivers/wifi/esp_hosted/esp_hosted_hal.c
// Full-duplex SPI transfer removes RX/TX buffer aliasing
int esp_hosted_hal_spi_transfer(const struct device *dev, void *tx, void *rx, uint32_t size)
{
	int ret = 0;
	const esp_hosted_config_t *config = dev->config;

	const struct spi_buf tx_buf = {.buf = tx, .len = size};
	const struct spi_buf_set tx_set = {.buffers = &tx_buf, .count = 1};

	const struct spi_buf rx_buf = {.buf = rx, .len = size};
	const struct spi_buf_set rx_set = {.buffers = &rx_buf, .count = 1};

	for (uint64_t start = k_uptime_get();; k_msleep(1)) {
		if (gpio_pin_get_dt(&config->handshake_gpio)) {
			break;
		}
		if ((k_uptime_get() - start) >= 100) {
			return -ETIMEDOUT;
		}
	}
}

Source: GitHub Commit 93c32f24

Detection Methods for CVE-2026-17054

Indicators of Compromise

Sudden and permanent loss of Wi-Fi reception on a Zephyr-based device requiring a hard reboot to restore connectivity.
Device faults or resets correlated with the presence of many nearby SSIDs or unusually long SSID strings.
Repeated stalls in the ESP-hosted RX thread with no draining of the control-event message queue.

Detection Strategies

Instrument the driver to log the raw TLV data_length value before it is passed to pb_istream_from_buffer() and flag values exceeding the receive buffer size.
Monitor for pb_decode() failures immediately following fragmented control responses on the SPI transport.
Track control-event message queue depth and alert when it approaches the eight-entry limit.

Monitoring Recommendations

Capture kernel fault logs and correlate them with local RF conditions such as scan operations and AP density.
Baseline normal fragment counts and lengths for control responses so that anomalous fragmentation patterns are visible.
Track device uptime and reboot frequency on fielded Zephyr endpoints to identify systemic DoS conditions.

How to Mitigate CVE-2026-17054

Immediate Actions Required

Update to the Zephyr revision containing commit 93c32f24, which introduces full-duplex SPI transfers and eliminates the aliasing that produces misaligned TLV parsing.
Rebuild all downstream firmware images that include the ESP-hosted Wi-Fi driver and redeploy to affected devices.
Audit any custom forks of drivers/wifi/esp_hosted/ to ensure data_length is validated against the receive buffer size before decode.

Patch Information

The fix is provided in Zephyr commit 93c32f240c9661f321233c134cfdd07f8dc97bb8. It converts esp_hosted_hal_spi_transfer() to a true full-duplex transfer, introduces separate TX and RX message queues (WIFI_ESP_HOSTED_TX_QUEUE_SIZE and WIFI_ESP_HOSTED_RX_QUEUE_SIZE), and adjusts the event task stack size. See GitHub Security Advisory GHSA-mq9g-c5j9-79v5 for full advisory details.

Workarounds

Where patching is not immediately possible, restrict deployment of affected devices to controlled RF environments with a small, known set of access points.
Implement an external hardware watchdog to force a device reset when the RX thread stalls, restoring Wi-Fi reception without manual intervention.
Disable active AP scanning features that request unsolicited scan lists from the co-processor to reduce exposure to attacker-controlled response sizes.

bash

# Configuration example: pull and build the patched driver
git fetch origin
git checkout 93c32f240c9661f321233c134cfdd07f8dc97bb8 -- drivers/wifi/esp_hosted/
west build -b <your_board> -p auto samples/net/wifi