Description
The Infineon Airoc Wi-Fi driver's transmit callback airoc_mgmt_send() in drivers/wifi/infineon/airoc_wifi.c allocates a net_buf from the fixed airoc_pool for every outbound packet. When whd_network_send_ethernet_data() returns a synchronous failure, the underlying WHD library does not take ownership of the buffer, but the pre-fix driver returned -EIO without releasing it. Each failed transmit therefore permanently leaks one buffer from the pool.

airoc_pool is small and fixed (AIROC_WIFI_TX_PACKET_POOL_COUNT + AIROC_WIFI_RX_PACKET_POOL_COUNT, default 20 buffers) and is shared by WHD's whd_host_buffer_get callback for both transmit and receive. Once enough send failures have leaked the pool dry, airoc_wifi_host_buffer_get() returns WHD_BUFFER_ALLOC_FAIL for all subsequent allocations, so both transmit and the WHD-driven receive path fail and Wi-Fi connectivity is lost until the device is rebooted.

The leak occurs only on the transmit error path. A Wi-Fi-adjacent attacker can influence the conditions that cause synchronous send failures (for example by deauthenticating/disassociating the station while the local stack continues to attempt transmits), and ordinary transient failures over the device's lifetime accumulate toward the same state. Reliable on-demand triggering is of high complexity and the impact is availability-only, but the resulting denial of service is permanent and non-recoverable without a reboot.

The fix releases the buffer with airoc_wifi_buffer_release() on the failure branch, returning it to the pool. The commit also removes a redundant k_sem_give() in airoc_mgmt_disconnect(); because data->sema_common is a binary semaphore (limit 1) the duplicate give merely saturated at 1 and had no security impact.
Published: 2026-08-22
Score: 5.3 Medium
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The flaw is a memory leak in the Infineon Airoc Wi‑Fi driver for the Zephyr RTOS. When a synchronous transmission failure occurs, the driver fails to reclaim a net_buf from a fixed‑size pool. Each failure permanently removes one buffer, and after a series of failures the pool is exhausted, causing both transmit and receive functions to fail and Wi‑Fi connectivity to be lost. This results in a denial of service that persists until the system is rebooted. The defect matches CWE‑401: Memory Leak.

Affected Systems

The vulnerability affects the Zephyr RTOS Wi‑Fi component provided by the Infineon Airoc driver, located in drivers/wifi/infineon/airoc_wifi.c. The driver is bundled with Zephyr and allocates a default pool of 20 buffers. Any embedded platform that builds Zephyr with the default Infineon Airoc driver is susceptible; specific vendor firmware versions are not listed in the CNA data.

Risk and Exploitability

The CVSS score of 5.3 indicates moderate severity, and no EPSS score is available, suggesting the exploitation likelihood is uncertain. The flaw is not in the CISA Known Exploited Vulnerabilities catalog. An attacker can trigger transmit failures by deauthenticating the station or inducing intermittent send errors. The impact is availability‑only and permanent; once the pool is exhausted the device must be rebooted to restore connectivity. Consequently the risk is significant for systems experiencing frequent transmission failures or exposed to deauthentication attacks.

Generated by OpenCVE AI on August 22, 2026 at 21:20 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the patch commit 4e6f624292ed153a762e98c7a297998c8d0b52c4 or upgrade to a Zephyr release that contains this fix.
  • Reconfigure or replace the fixed buffer pool with a larger pool if application constraints allow, to reduce the likelihood of exhaustion.
  • If the patch cannot be applied immediately, schedule regular reboots or implement a watchdog reset to recover Wi‑Fi connectivity when buffer exhaustion is detected.

Generated by OpenCVE AI on August 22, 2026 at 21:20 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sat, 22 Aug 2026 20:45:00 +0000

Type Values Removed Values Added
Description The Infineon Airoc Wi-Fi driver's transmit callback airoc_mgmt_send() in drivers/wifi/infineon/airoc_wifi.c allocates a net_buf from the fixed airoc_pool for every outbound packet. When whd_network_send_ethernet_data() returns a synchronous failure, the underlying WHD library does not take ownership of the buffer, but the pre-fix driver returned -EIO without releasing it. Each failed transmit therefore permanently leaks one buffer from the pool. airoc_pool is small and fixed (AIROC_WIFI_TX_PACKET_POOL_COUNT + AIROC_WIFI_RX_PACKET_POOL_COUNT, default 20 buffers) and is shared by WHD's whd_host_buffer_get callback for both transmit and receive. Once enough send failures have leaked the pool dry, airoc_wifi_host_buffer_get() returns WHD_BUFFER_ALLOC_FAIL for all subsequent allocations, so both transmit and the WHD-driven receive path fail and Wi-Fi connectivity is lost until the device is rebooted. The leak occurs only on the transmit error path. A Wi-Fi-adjacent attacker can influence the conditions that cause synchronous send failures (for example by deauthenticating/disassociating the station while the local stack continues to attempt transmits), and ordinary transient failures over the device's lifetime accumulate toward the same state. Reliable on-demand triggering is of high complexity and the impact is availability-only, but the resulting denial of service is permanent and non-recoverable without a reboot. The fix releases the buffer with airoc_wifi_buffer_release() on the failure branch, returning it to the pool. The commit also removes a redundant k_sem_give() in airoc_mgmt_disconnect(); because data->sema_common is a binary semaphore (limit 1) the duplicate give merely saturated at 1 and had no security impact.
Title Infineon Airoc Wi-Fi driver leaks TX buffers on send failure, leading to permanent pool exhaustion
Weaknesses CWE-401
References
Metrics cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: zephyr

Published:

Updated: 2026-08-22T20:35:40.445Z

Reserved: 2026-06-23T13:18:10.190Z

Link: CVE-2026-12999

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-08-22T21:16:48.747

Modified: 2026-08-22T21:16:48.747

Link: CVE-2026-12999

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-22T21:30:16Z

Weaknesses
  • CWE-401

    Missing Release of Memory after Effective Lifetime