CVE-2026-12999: Infineon Airoc Wi-Fi Driver DoS Vulnerability

CVE-2026-12999 Overview

CVE-2026-12999 is a memory leak vulnerability [CWE-401] in the Zephyr RTOS Infineon Airoc Wi-Fi driver. The transmit callback airoc_mgmt_send() in drivers/wifi/infineon/airoc_wifi.c allocates a net_buf from the fixed airoc_pool for every outbound packet. When whd_network_send_ethernet_data() returns a synchronous failure, the WHD library does not take ownership of the buffer, but the pre-fix driver returned -EIO without releasing it. Each failed transmit permanently leaks one buffer from the shared pool.

Critical Impact
Once the pool is exhausted, both transmit and WHD-driven receive paths fail. Wi-Fi connectivity is permanently lost until the device is rebooted.

Affected Products

Zephyr RTOS Infineon Airoc Wi-Fi driver (drivers/wifi/infineon/airoc_wifi.c)
Devices using the WHD (Wi-Fi Host Driver) library with airoc_pool buffer management
Embedded systems relying on Infineon Airoc Wi-Fi connectivity in Zephyr

Discovery Timeline

2026-08-22 - CVE-2026-12999 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-12999

Vulnerability Analysis

The defect resides in the transmit error path of airoc_mgmt_send(). On every outbound packet, the driver allocates a net_buf from airoc_pool and hands it to whd_network_send_ethernet_data(). When that call succeeds asynchronously, WHD releases the buffer. When it returns a synchronous failure, ownership stays with the driver, which previously returned -EIO without freeing the buffer.

The airoc_pool is sized at AIROC_WIFI_TX_PACKET_POOL_COUNT + AIROC_WIFI_RX_PACKET_POOL_COUNT (default 20 buffers) and is shared with the whd_host_buffer_get callback for both transmit and receive. Once send failures drain the pool, airoc_wifi_host_buffer_get() returns WHD_BUFFER_ALLOC_FAIL for all subsequent allocations. This breaks both the transmit path and the WHD-driven receive path, producing a permanent, non-recoverable loss of Wi-Fi connectivity until reboot.

Root Cause

The root cause is missing buffer release logic on the synchronous failure branch of whd_network_send_ethernet_data(). The driver assumed WHD consumed the buffer on all outcomes. Because airoc_pool is small, fixed, and shared between TX and RX, even a low rate of synchronous send failures accumulates toward pool exhaustion over the device's lifetime.

Attack Vector

A Wi-Fi-adjacent attacker can influence the conditions that produce synchronous send failures. For example, an attacker can repeatedly deauthenticate or disassociate the station while the local network stack continues to attempt transmits. Each induced failure leaks one buffer. Reliable on-demand triggering is high complexity, and impact is availability-only, but ordinary transient failures over normal operation converge on the same denial-of-service state.

 	ret = whd_network_send_ethernet_data(airoc_if, (void *)buf);
 	if (ret != CY_RSLT_SUCCESS) {
 		LOG_ERR("whd_network_send_ethernet_data failed");
+		/* WHD does not consume the buffer on a synchronous failure, so
+		 * release it here to avoid leaking it from the TX pool.
+		 */
+		airoc_wifi_buffer_release((whd_buffer_t)buf, WHD_NETWORK_TX);
 #if defined(CONFIG_NET_STATISTICS_WIFI)
 		data->stats.errors.tx++;
 #endif

Source: Zephyr GitHub Commit 4e6f6242

Detection Methods for CVE-2026-12999

Indicators of Compromise

Repeated whd_network_send_ethernet_data failed log messages from the Airoc driver.
Increasing data->stats.errors.tx counters when CONFIG_NET_STATISTICS_WIFI is enabled.
Sustained deauthentication or disassociation frames targeting the device's BSSID from a Wi-Fi-adjacent source.
Wi-Fi connectivity loss on affected devices that only recovers after a hardware reboot.

Detection Strategies

Monitor Zephyr device logs for the LOG_ERR string emitted by airoc_mgmt_send() on transmit failure.
Track net_buf pool occupancy via Zephyr's buffer statistics APIs to detect a monotonic decrease in free airoc_pool buffers.
Correlate Wi-Fi disassociation events at the AP with rising TX error counts on the client device.

Monitoring Recommendations

Alert on unrecoverable Wi-Fi loss events that require a device reboot to restore connectivity.
Baseline the normal rate of synchronous TX failures and flag deviations that indicate deauthentication flooding.
Aggregate embedded device telemetry so pool-exhaustion patterns across a fleet are visible over time.

How to Mitigate CVE-2026-12999

Immediate Actions Required

Apply the upstream Zephyr fix that adds airoc_wifi_buffer_release() on the failure branch of airoc_mgmt_send().
Rebuild and reflash affected firmware images for all devices using the Infineon Airoc Wi-Fi driver.
Audit deployed fleets for devices exhibiting repeated TX failures or requiring periodic reboots to restore Wi-Fi.

Patch Information

The fix is available in the Zephyr commit 4e6f624292ed153a762e98c7a297998c8d0b52c4. The patch releases the buffer with airoc_wifi_buffer_release((whd_buffer_t)buf, WHD_NETWORK_TX) on the synchronous failure branch, returning it to airoc_pool. The same commit also removes a redundant k_sem_give() in airoc_mgmt_disconnect(); because data->sema_common is a binary semaphore (limit 1), the duplicate give had no security impact. See the GitHub Security Advisory GHSA-8w97-ghfm-5wjp for advisory details.

Workarounds

Where patching is not yet possible, schedule periodic reboots to reset the airoc_pool state before exhaustion.
Reduce exposure to Wi-Fi-adjacent attackers by deploying management frame protection (802.11w) on connected APs.
Increase AIROC_WIFI_TX_PACKET_POOL_COUNT and AIROC_WIFI_RX_PACKET_POOL_COUNT to delay exhaustion, understanding this only extends time-to-failure.

bash

# Fetch and apply the upstream Zephyr fix
git fetch origin
git cherry-pick 4e6f624292ed153a762e98c7a297998c8d0b52c4
west build -b <board> samples/net/wifi
west flash