CVE-2026-1679
Buffer Overflow in eswifi Driver Allows Local Kernel Memory Corruption
Publication date: 2026-03-28
Last updated on: 2026-03-31
Assigner: Zephyr Project
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| zephyrproject | zephyr | to 4.3.0 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-120 | The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer. |
Attack-Flow Graph
AI Powered Q&A
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability occurs in the eswifi socket offload driver when user-provided payloads exceed the fixed buffer size, causing a buffer overflow. Detection involves monitoring for abnormal kernel memory corruption or crashes related to the eswifi socket send API.
Since exploitation requires local code execution privileges to call the socket send API, detection can focus on identifying attempts to send oversized payloads through this API.
A proof-of-concept uses AddressSanitizer (ASAN) to detect the overflow by sending oversized payloads, so running tests with ASAN enabled on the eswifi socket send function can help detect the issue.
No specific network commands are provided in the resources, but monitoring kernel logs for memory corruption or crashes related to eswifi, and auditing local applications that use the eswifi socket send API for payload sizes exceeding CONFIG_WIFI_ESWIFI_MAX_DATA_SIZE, can help detect exploitation attempts.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include restricting local code execution privileges to trusted users and applications, since exploitation requires local access to call the eswifi socket send API.
Audit and control any application code that can invoke the eswifi socket offload send path to ensure it does not send payloads larger than the configured buffer size (CONFIG_WIFI_ESWIFI_MAX_DATA_SIZE).
Monitor for kernel crashes or memory corruption symptoms related to eswifi and consider disabling or limiting use of the eswifi socket offload driver if possible until a patch is available.
At the time of the advisory, no patched versions are available, so applying strict access controls and payload size validation are the best immediate defenses.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability in the eswifi socket offload driver can lead to kernel memory corruption, potentially resulting in denial of service or arbitrary code execution. Such impacts on system integrity and availability could affect compliance with standards like GDPR and HIPAA, which require protection of data integrity and system availability.
However, the vulnerability requires local code execution privileges and cannot be exploited remotely, which limits the attack surface.
No specific information is provided about direct compliance implications or mitigation steps related to these regulations.
Can you explain this vulnerability to me?
CVE-2026-1679 is a high-severity buffer overflow vulnerability in the eswifi socket offload driver of the Zephyr RTOS (versions ≤ 4.3). The vulnerability occurs because the driver copies user-provided payloads into a fixed-size buffer without checking if there is enough space. Specifically, it builds a header string in the buffer and then appends the payload using memcpy without verifying the payload fits, which can overflow the buffer and corrupt kernel memory.
Exploitation requires local code that can call the socket send API; it cannot be exploited remotely. The overflow happens before a kernel function call, potentially leading to denial of service or arbitrary code execution.
How can this vulnerability impact me? :
This vulnerability can impact you by allowing local attackers with the ability to call the eswifi socket send API to corrupt kernel memory. This can lead to denial of service, causing the system or device to crash or become unstable.
More severely, the memory corruption could be exploited to achieve arbitrary code execution within the kernel, potentially allowing an attacker to escalate privileges or take control of the affected system.