CVE-2026-10665

Name of the Vulnerable Software and Affected Versions Zephyr version 4.4.0

Description An out-of-bounds write exists in the WireGuard subsystem within the wg process data message() function located in wg crypto.c. The issue occurs when an inbound transport-data payload is linearized into a fixed pool buffer. Because the net buf linearize() function is called using an attacker-controlled data len as both the destination capacity and the copy length, the internal boundary check is bypassed. If data len exceeds the CONFIG WIREGUARD BUF LEN limit—which can happen via reassembled IPv4/IPv6 fragments or when the buffer length is lower than the link MTU—the system performs a memcpy that writes past the end of the pool buffer. This memory corruption occurs before the Poly1305 authentication check, allowing a malicious peer or on-path attacker with a valid receiver session index to trigger a remote denial of service.

Recommendations Update Zephyr version 4.4.0 to a version containing the fix that implements an explicit rejection of data len exceeding CONFIG WIREGUARD BUF LEN and corrects the net buf linearize() call to use net buf max len(buf) as the destination capacity.