OpenBSD wg(4) buffer-size error can crash the kernel

In OpenBSD 7.6 before errata 006 and OpenBSD 7.5 before errata 015, traffic sent over wg(4) could result in kernel crash.

• OpenBSD 7.6: affected before 7.6 errata 006; 7.6 errata 006 provides the fix for this issue.
• OpenBSD 7.5: affected before 7.5 errata 015; 7.5 errata 015 provides the fix for this issue.
• The status of other branches or parallel release branches is not established by the available evidence.

The affected component is the OpenBSD kernel wg(4) implementation, with the relevant source in sys/net/if_wg.c. The fix changes mbuf allocation and alignment, replaces m_copyback() with memcpy() for a single mbuf, removes unnecessary m_calchdrlen() handling, and adjusts length calculations in wg_encap(). The fixing commit states that using min() with t->t_mtu when calculating plaintext_len and out_len was not handled correctly and had severe consequences. The confirmed input is traffic sent over wg(4). The record characterizes the attack as network-reachable, requiring low privileges, requiring no user interaction, and having low complexity; the specific authentication model is not further described. The available evidence does not establish whether the size-calculation error causes an out-of-bounds access, memory corruption, or another memory-handling failure before the kernel crash.

The flaw can be triggered through network traffic sent over wg(4). The record identifies low privilege requirements, no user interaction, and low complexity; it does not specify how an attacker obtains the required privilege.

No public exploit is identified in the supplied record, and the record does not provide a known-exploited status. This does not prove that exploitation has never occurred. No exploit payload, attack sequence, indicator, or specific exploitation procedure is confirmed.

• Technical outcome: traffic through wg(4) can cause a kernel crash and loss of system availability.
• Scope: the described impact is to the kernel of the host processing the traffic; the record does not confirm propagation to other systems.
• Confidentiality and integrity: no evidence is provided of unauthorized data access or modification.
• Limits: there is no confirmed evidence that the flaw enables privilege escalation, code execution, or persistence.

A successful trigger can crash the kernel and interrupt a server or gateway using wg(4) until the system is recovered. For hosts providing VPN or routing functions, WireGuard connectivity may be disrupted and service restoration may require recovery or installation of a fixed kernel. The record does not confirm data disclosure, unauthorized data modification, or privilege escalation. The frequency of crashes and whether a specific traffic sequence can repeatedly trigger the issue are not documented.

1. For OpenBSD 7.6, apply 7.6 errata 006.
2. For OpenBSD 7.5, apply 7.5 errata 015.
3. After applying the patch, rebuild and install a new kernel according to the errata instructions, then verify that the system is running the updated kernel.
4. No separate workaround or temporary mitigation is documented in the sources reviewed. A fix for one branch should not be treated as evidence that every other branch is unaffected.

1. Inventory OpenBSD systems and record their release, errata level, running kernel, and whether wg(4) is configured or in use.
2. Prioritize systems using wg(4), then verify that the running kernel was rebuilt and installed with the applicable fix.
3. Review kernel crash, reboot, or service-loss events that coincide with traffic over wg(4). Treat this as precautionary monitoring rather than a specific indicator.
4. No specific log signature or IOC is provided. The absence of crash evidence does not prove that a system is safe.