CVE-2026-10664

{
  "id": "CVE-2026-10664",
  "sourceIdentifier": "[email protected]",
  "published": "2026-07-12T17:16:24.317",
  "lastModified": "2026-10-24T22:10:00.210",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "The nRF70 Wi-Fi driver's power-save event handler nrf_wifi_event_proc_get_power_save_info() in drivers/wifi/nrf_wifi/src/wifi_mgmt.c copied TWT (Target Wake Time) flow entries from an nrf_wifi_umac_event_power_save_info event into the fixed-size twt_flows[WIFI_MAX_TWT_FLOWS] (8-element) array of a caller-supplied struct wifi_ps_config, looping over event-provided num_twt_flows without validating it against WIFI_MAX_TWT_FLOWS or checking event_len. When num_twt_flows exceeds 8, the handler writes past the destination array (which is typically on the caller's stack, e.g. the wifi ps shell command) -- an out-of-bounds write of ~40-byte TWT entries -- and reads twt_flow_info[i] past the event buffer. The event is delivered by the nRF70 co-processor firmware in response to a host-initiated power-save GET, so reaching the overflow requires the firmware to emit a malformed or out-of-range event; the trust boundary is host-to-trusted-coprocessor rather than a direct remote-AP write, with over-the-air influence on the flow count being indirect and bounded by the 3-bit TWT flow-id space. Affected: builds with CONFIG_NRF70_STA_MODE on releases through v4.4.0. The fix rejects events with num_twt_flows > WIFI_MAX_TWT_FLOWS or with event_len shorter than the claimed entries, and adds a NULL check on the caller buffer."
    },
    {
      "lang": "es",
      "value": "El gestor de eventos de ahorro de energía del controlador Wi-Fi nRF70 nrf_wifi_event_proc_get_power_save_info() en drivers/wifi/nrf_wifi/src/wifi_mgmt.c copió entradas de flujo TWT (Target Wake Time) de un evento nrf_wifi_umac_event_power_save_info en el array de tamaño fijo twt_flows[WIFI_MAX_TWT_FLOWS] (de 8 elementos) de una estructura wifi_ps_config proporcionada por el llamador, iterando sobre num_twt_flows proporcionado por el evento sin validarlo contra WIFI_MAX_TWT_FLOWS o verificar event_len. Cuando num_twt_flows excede 8, el gestor escribe más allá del array de destino (que típicamente está en la pila del llamador, p. ej. el comando de shell wifi ps) -- una escritura fuera de límites de entradas TWT de ~40 bytes -- y lee twt_flow_info[i] más allá del búfer del evento. El evento es entregado por el firmware del coprocesador nRF70 en respuesta a un GET de ahorro de energía iniciado por el host, por lo que alcanzar el desbordamiento requiere que el firmware emita un evento malformado o fuera de rango; el límite de confianza es de host a coprocesador de confianza en lugar de una escritura directa de AP remoto, con la influencia por aire en el recuento de flujos siendo indirecta y limitada por el espacio de ID de flujo TWT de 3 bits. Afectado: compilaciones con CONFIG_NRF70_STA_MODE en versiones hasta la v4.4.0. La corrección rechaza eventos con num_twt_flows > WIFI_MAX_TWT_FLOWS o con event_len más corto que las entradas declaradas, y añade una verificación de NULL en el búfer del llamador."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "zephyrproject",
          "product": "zephyr",
          "defaultStatus": "unaffected",
          "collectionURL": "https://github.com/zephyrproject-rtos/zephyr",
          "packageName": "zephyr",
          "programFiles": [
            "drivers/wifi/nrf_wifi/src/wifi_mgmt.c"
          ],
          "versions": [
            {
              "version": "4.4.0",
              "lessThan": "4.4.1",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L",
          "baseScore": 5.0,
          "baseSeverity": "MEDIUM",
          "attackVector": "ADJACENT_NETWORK",
          "attackComplexity": "HIGH",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "availabilityImpact": "LOW"
        },
        "exploitabilityScore": 1.6,
        "impactScore": 3.4
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-07-13T15:47:33.072312Z",
          "id": "CVE-2026-10664",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-787"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:zephyrproject:zephyr:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "4.0.0",
              "versionEndExcluding": "4.5.0",
              "matchCriteriaId": "4F363494-36D4-4242-B8FB-1E4437D12664"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/zephyrproject-rtos/zephyr/commit/a2c4324acd50a5f92e492e6e460e6297af826148",
      "source": "[email protected]",
      "tags": [
        "Patch"
      ]
    },
    {
      "url": "https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-3r6j-pm38-r43m",
      "source": "[email protected]",
      "tags": [
        "Exploit",
        "Mitigation",
        "Patch",
        "Vendor Advisory"
      ]
    },
    {
      "url": "https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-3r6j-pm38-r43m",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "tags": [
        "Exploit",
        "Mitigation",
        "Patch",
        "Vendor Advisory"
      ]
    }
  ]
}