Description
The Silicon Labs SiWx917 WiFi driver's transmit callback siwx91x_send() in drivers/wifi/siwx91x/siwx91x_wifi.c frees a network packet it does not own. In the Zephyr TX path the net_pkt is owned by the L2/networking stack; the driver only borrows it to copy the frame bytes into a local net_buf. Before the fix, after transmitting, siwx91x_send() additionally called net_pkt_unref(pkt) on the caller-owned packet, dropping its last reference and returning it to the shared packet pool prematurely. This code path is compiled in by default (CONFIG_WIFI_SILABS_SIWX91X_NET_STACK_NATIVE).

The caller, ethernet_send() in subsys/net/l2/ethernet/ethernet.c, keeps using the packet after the driver returns: it reads net_pkt_get_len(pkt), updates TX statistics, and then performs its own net_pkt_unref(pkt). Because the driver already released the packet, these are use-after-free reads followed by a second unref (a double free). When concurrent network activity recycles the freed slab slot between the two unrefs, the trailing unref decrements a different, live packet's reference count and frees it, corrupting the net_pkt pool shared by both the receive and transmit paths.

The defect is exercised by ordinary transmission over the native-stack SiWx917 WiFi interface, and an adjacent attacker on the same WiFi network can induce transmissions (for example ARP or ICMP echo replies, or TCP handshakes) to drive the path. The primary observable impact is loss of availability (transmit hangs and crashes from pool corruption), with race-dependent memory corruption of the kernel networking buffer pool. The fix removes the erroneous net_pkt_unref(pkt) from siwx91x_send(); the driver's receive-path unref, which correctly frees a packet the driver itself allocated, is unaffected.
Published: 2026-08-31
Score: 6.4 Medium
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The defect in the Silicon Labs SiWx917 WiFi driver causes an unintended unreference of a network packet that is owned by the Zephyr networking stack. After transmitting, the driver drops the last reference and returns the packet to the shared pool, while the stack continues to read and later also releases the same packet. This results in use‑after‑free reads followed by a double free, corrupting the kernel‑level packet buffer pool and causing the system to crash or hang during normal traffic.

Affected Systems

Affected deployments are Zephyr RTOS builds that include the Silicon Labs SiWx917 driver compiled with CONFIG_WIFI_SILABS_SIWX91X_NET_STACK_NATIVE. The vulnerability exists in the driver code path within drivers/wifi/siwx91x/siwx91x_wifi.c and the Zephyr networking stack in subsys/net/l2/ethernet/ethernet.c. Any build using this driver configuration is vulnerable.

Risk and Exploitability

The CVSS score of 6.4 indicates moderate severity, yet the primary impact is loss of availability and possible memory corruption. EPSS data is not available, and the vulnerability is not listed in CISA KEV, but an external attacker on the same WiFi network can trigger the faulty path by generating traffic such as ARP or TCP handshakes that cause the driver to transmit. Because the corruption depends on race conditions, success is not guaranteed but the risk remains high for unpatched systems.

Generated by OpenCVE AI on August 31, 2026 at 18:21 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Zephyr to a version that includes the SiWx917 driver patch, which removes the erroneous net_pkt_unref call from siwx91x_send.
  • Restart the device after the firmware update to clear any corrupted packet buffer state.
  • If an immediate upgrade is not possible, recompile the Zephyr project with the corrected driver code from the provided commit or disable CONFIG_WIFI_SILABS_SIWX91X_NET_STACK_NATIVE until the fix is applied, thereby preventing the driver from being used on the network stack.

Generated by OpenCVE AI on August 31, 2026 at 18:21 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 31 Aug 2026 18:45:00 +0000

Type Values Removed Values Added
First Time appeared Zephyrproject
Zephyrproject zephyr
Vendors & Products Zephyrproject
Zephyrproject zephyr

Mon, 31 Aug 2026 17:00:00 +0000

Type Values Removed Values Added
Description The Silicon Labs SiWx917 WiFi driver's transmit callback siwx91x_send() in drivers/wifi/siwx91x/siwx91x_wifi.c frees a network packet it does not own. In the Zephyr TX path the net_pkt is owned by the L2/networking stack; the driver only borrows it to copy the frame bytes into a local net_buf. Before the fix, after transmitting, siwx91x_send() additionally called net_pkt_unref(pkt) on the caller-owned packet, dropping its last reference and returning it to the shared packet pool prematurely. This code path is compiled in by default (CONFIG_WIFI_SILABS_SIWX91X_NET_STACK_NATIVE). The caller, ethernet_send() in subsys/net/l2/ethernet/ethernet.c, keeps using the packet after the driver returns: it reads net_pkt_get_len(pkt), updates TX statistics, and then performs its own net_pkt_unref(pkt). Because the driver already released the packet, these are use-after-free reads followed by a second unref (a double free). When concurrent network activity recycles the freed slab slot between the two unrefs, the trailing unref decrements a different, live packet's reference count and frees it, corrupting the net_pkt pool shared by both the receive and transmit paths. The defect is exercised by ordinary transmission over the native-stack SiWx917 WiFi interface, and an adjacent attacker on the same WiFi network can induce transmissions (for example ARP or ICMP echo replies, or TCP handshakes) to drive the path. The primary observable impact is loss of availability (transmit hangs and crashes from pool corruption), with race-dependent memory corruption of the kernel networking buffer pool. The fix removes the erroneous net_pkt_unref(pkt) from siwx91x_send(); the driver's receive-path unref, which correctly frees a packet the driver itself allocated, is unaffected.
Title SiWx91x WiFi driver double-unref / use-after-free of caller-owned TX net_pkt
Weaknesses CWE-416
References
Metrics cvssV3_1

{'score': 6.4, 'vector': 'CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H'}

Subscriptions

Zephyrproject Zephyr
cve-icon MITRE

Status: PUBLISHED

Assigner: zephyr

Published:

Updated: 2026-08-31T16:47:48.478Z

Reserved: 2026-07-01T19:30:18.997Z

Link: CVE-2026-14366

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-08-31T17:17:36.920

Modified: 2026-08-31T17:17:36.920

Link: CVE-2026-14366

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-31T18:30:03Z

Weaknesses