Executive brief
A vulnerability exists in the Wi-Fi driver for nRF70 series chips used in the Zephyr operating system. The driver fails to properly check the size of incoming data when managing power-saving features, which can allow a malformed message from the Wi-Fi co-processor to overwrite system memory. This could lead to device crashes, unauthorized access to sensitive memory, or the execution of malicious code, particularly when using the Wi-Fi command-line interface.
Technical details
An out-of-bounds (OOB) write and OOB read vulnerability exists in `nrf_wifi_event_proc_get_power_save_info()` within `drivers/wifi/nrf_wifi/src/wifi_mgmt.c`. The handler trusts the `num_twt_flows` field from the `nrf_wifi_umac_event_power_save_info` event without validating it against the fixed-size `twt_flows` array (8 elements) in the destination `wifi_ps_config` struct. Because this destination struct is often stack-allocated (e.g., in the Wi-Fi shell), an attacker capable of influencing the nRF70 co-processor firmware can trigger a stack overflow. This can result in cross-thread stack corruption and potential memory disclosure when the corrupted object is later traversed. The fix involves validating `num_twt_flows` against `WIFI_MAX_TWT_FLOWS` and verifying the `event_len` matches the claimed data size.
Affected products
- Zephyr Project Zephyr RTOS v4.0.0 through v4.4.0
Timeline
- 2026-07-12: advisory: GHSA-3r6j-pm38-r43m published
- 2026-07-12: patched: Fix merged into main and stable branches