Zephyr nRF70 Driver CVE-2026-10664

Exploitation requires: (1) the target firmware must be built with CONFIG_NRF70_STA_MODE enabled - this is an explicit Kconfig build-time flag, not the default for all Zephyr targets; (2) the host must initiate a power-save GET query (e.g., via the wifi ps shell command or equivalent API call) to trigger the vulnerable event handler; (3) the nRF70 co-processor must return a malformed event with num_twt_flows > 8 - this requires either co-processor firmware compromise or indirect manipulation via a rogue Wi-Fi 6 AP exploiting the TWT negotiation protocol to poison the co-processor's internal flow state. Limiting factors: the 3-bit TWT flow-id field constrains over-the-air influence; the trust boundary is host-to-co-processor rather than direct network-to-host; bare-metal RTOS targets typically lack ASLR and stack canaries (increasing exploitability if reached), but the multi-step path to reach the overflow significantly reduces opportunistic exploitation likelihood.

The NVD-assigned CVSS 3.1 score of 5.0 (AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L) reflects the constrained attack path accurately: exploitation requires adjacent-network positioning AND the ability to manipulate co-processor firmware or TWT session state via a rogue AP - both non-trivial preconditions that justify AC:H. The C:L rating stems from the OOB read past the event buffer, while I:L and A:L capture the stack corruption potential. No EPSS data was provided; given the niche footprint (Zephyr IoT RTOS on devices with nRF70 chipsets) and the multi-hop attack path (AP → TWT negotiation → co-processor → host event), real-world exploitation probability is likely very low. The flaw is not in CISA KEV and no POC is known, further depressing immediate risk. However, for IoT devices in environments with untrusted Wi-Fi infrastructure (e.g., industrial sensors using public or shared Wi-Fi), the severity is elevated because stack-based OOB writes in RTOS kernels can be deterministically exploited on bare-metal systems lacking ASLR or stack canaries. The primary priority signal is the upstream fix commit available in the Zephyr repository - affected projects should integrate it before shipping hardware.

An attacker operating a rogue 802.11ax (Wi-Fi 6) access point crafts TWT session responses that cause the nRF70 co-processor to record more than eight TWT flow entries in its internal state. When the host application or shell command triggers a power-save GET query, the co-processor returns an nrf_wifi_umac_event_power_save_info event with num_twt_flows exceeding 8; the unvalidated loop in nrf_wifi_event_proc_get_power_save_info() then writes ~40 bytes per excess entry past the end of the stack-allocated twt_flows array, potentially overwriting return addresses or adjacent stack variables on bare-metal RTOS targets lacking exploit mitigations.