CVE-2026-14366: SiWx917 WiFi Driver Use-After-Free

CVE-2026-14366 is a use-after-free flaw in Silicon Labs SiWx917 WiFi driver that causes memory corruption through improper packet handling. Adjacent attackers can trigger crashes and DoS. This article covers technical details, impact analysis, affected driver versions, and available mitigation strategies.

CVE-2026-14366 Overview

CVE-2026-14366 is a use-after-free and double-free vulnerability [CWE-416] in the Silicon Labs SiWx917 WiFi driver shipped with the Zephyr RTOS. The transmit callback siwx91x_send() in drivers/wifi/siwx91x/siwx91x_wifi.c calls net_pkt_unref(pkt) on a net_pkt it does not own. The L2 networking stack retains ownership of the packet and dereferences it again after the driver returns, producing a second unref. The affected code path is compiled by default under CONFIG_WIFI_SILABS_SIWX91X_NET_STACK_NATIVE.

Critical Impact
An adjacent attacker on the same WiFi network can trigger transmissions such as ARP or ICMP replies to corrupt the shared net_pkt pool, causing transmit hangs, kernel crashes, and race-dependent memory corruption of networking buffers.

Affected Products

Zephyr RTOS builds enabling the SiWx917 WiFi driver
Silicon Labs SiWx917 WiFi driver (drivers/wifi/siwx91x/siwx91x_wifi.c)
Configurations built with CONFIG_WIFI_SILABS_SIWX91X_NET_STACK_NATIVE

Discovery Timeline

2026-08-31 - CVE-2026-14366 published to NVD
2026-09-01 - Last updated in NVD database

Technical Details for CVE-2026-14366

Vulnerability Analysis

The defect resides in the Zephyr TX path for the SiWx917 WiFi interface. In Zephyr's networking model, the net_pkt structure passed to a driver's send callback is owned by the L2 stack. The driver may borrow it to copy frame bytes into a local net_buf, but must not release it. siwx91x_send() violated this contract by invoking net_pkt_unref(pkt) after transmission, dropping the last reference and returning the packet to the shared slab pool prematurely.

The caller ethernet_send() in subsys/net/l2/ethernet/ethernet.c continues to use the packet after the driver returns. It reads net_pkt_get_len(pkt) to update TX statistics, then performs its own net_pkt_unref(pkt). Both operations execute against a freed slab slot.

Root Cause

The root cause is incorrect ownership assumptions in the driver's transmit callback. The receive path correctly frees packets the driver itself allocates, but the transmit path erroneously freed a caller-owned buffer. This is a classic use-after-free [CWE-416] compounded by a double free.

Attack Vector

An attacker adjacent to the target on the same WiFi network can induce outbound transmissions by sending ARP requests, ICMP echo requests, or initiating TCP handshakes. Each transmission exercises the defective code path. When concurrent network activity recycles the freed slab slot between the two unrefs, the trailing unref decrements the reference count of a different live packet and frees it, corrupting the shared net_pkt pool used by both RX and TX paths. The primary impact is availability loss through transmit hangs and pool corruption crashes.

 		return -EIO;
 	}
 
-	net_pkt_unref(pkt);
 	net_buf_unref(buf);
 
 	return 0;

Source: Zephyr commit 680a351c. The patch removes the erroneous net_pkt_unref(pkt) from siwx91x_send(), leaving the caller ethernet_send() as the sole owner responsible for releasing the packet.

Detection Methods for CVE-2026-14366

Indicators of Compromise

Unexplained kernel crashes or panics originating from the networking subsystem on SiWx917-based devices
Transmit hangs and dropped frames on the WiFi interface under normal ARP or ICMP traffic
net_pkt pool exhaustion warnings or slab corruption assertions in Zephyr logs

Detection Strategies

Audit build configurations for CONFIG_WIFI_SILABS_SIWX91X_NET_STACK_NATIVE=y combined with vulnerable Zephyr revisions predating commit 680a351c.
Instrument networking pool statistics and monitor for reference count anomalies during sustained TX activity.
Run stress tests that generate ARP or ICMP flood traffic against the device and observe for crashes or transmit stalls.

Monitoring Recommendations

Collect device serial logs and crash dumps and forward them to a central analytics platform for anomaly correlation.
Track WiFi interface uptime and TX failure counters to catch progressive degradation.
Watch adjacent-network telemetry for unauthorized devices generating unusual ARP or ICMP volumes.

How to Mitigate CVE-2026-14366

Immediate Actions Required

Update Zephyr source trees to include commit 680a351c7dd0ba46eb67d9c0e7165d901a7bd3d1 and rebuild firmware for affected SiWx917 devices.
Inventory deployed devices that use the SiWx917 native networking stack and prioritize firmware rollout.
Restrict WiFi network access using WPA2/WPA3 authentication and network segmentation to reduce adjacent-attacker exposure.

Patch Information

The fix is available in the upstream Zephyr repository via commit 680a351c. The patch removes the incorrect net_pkt_unref(pkt) call from siwx91x_send(). Additional detail is available in the Zephyr Security Advisory GHSA-f9qq-jv4w-pqxg.

Workarounds

Disable the native SiWx917 networking stack by unsetting CONFIG_WIFI_SILABS_SIWX91X_NET_STACK_NATIVE where feasible.
Deploy devices only on trusted, authenticated WiFi networks to limit adjacent-attacker access.
Cherry-pick commit 680a351c into downstream forks if a full Zephyr upgrade is not immediately practical.

bash

# Apply the upstream fix to a local Zephyr checkout
cd zephyr
git fetch origin
git cherry-pick 680a351c7dd0ba46eb67d9c0e7165d901a7bd3d1
west build -b <siwx917_board> <application>