WireGuard: Peer endpoint hijacking via unauthenticated UDP packets (CVE-2026-79977)

The WireGuard implementation in subsys/net/lib/wireguard/wg.c updates the peer endpoint from an unauthenticated transport-data message. In handle_transport_data(), if the 32-bit receiver index of an incoming message does not match a session, the code copies the datagram's source address into peer->endpoint using memcpy. Because the receiver index is unknown and unverified, an attacker can supply an arbitrary address.

The listener, which defaults to UDP port 51820, does not filter by remote address or cryptographic identity, allowing any host capable of sending a UDP datagram to trigger this update if the peer lacks a valid handshake or current keypair. This redirects subsequent handshake initiations, keepalives, and encrypted data to the attacker-supplied address, causing a loss of availability and potential man-in-the-middle positioning. End-to-end cryptography prevents decryption or forgery of tunnel content. CONFIG_WIREGUARD is experimental and not enabled by default.