CVE-2026-12999
Infineon Airoc Wi-Fi driver leaks TX buffers on send failure, leading to permanent pool exhaustion
Description
The Infineon Airoc Wi-Fi driver's transmit callback airoc_mgmt_send() in drivers/wifi/infineon/airoc_wifi.c allocates a net_buf from the fixed airoc_pool for every outbound packet. When whd_network_send_ethernet_data() returns a synchronous failure, the underlying WHD library does not take ownership of the buffer, but the pre-fix driver returned -EIO without releasing it. Each failed transmit therefore permanently leaks one buffer from the pool. airoc_pool is small and fixed (AIROC_WIFI_TX_PACKET_POOL_COUNT + AIROC_WIFI_RX_PACKET_POOL_COUNT, default 20 buffers) and is shared by WHD's whd_host_buffer_get callback for both transmit and receive. Once enough send failures have leaked the pool dry, airoc_wifi_host_buffer_get() returns WHD_BUFFER_ALLOC_FAIL for all subsequent allocations, so both transmit and the WHD-driven receive path fail and Wi-Fi connectivity is lost until the device is rebooted. The leak occurs only on the transmit error path. A Wi-Fi-adjacent attacker can influence the conditions that cause synchronous send failures (for example by deauthenticating/disassociating the station while the local stack continues to attempt transmits), and ordinary transient failures over the device's lifetime accumulate toward the same state. Reliable on-demand triggering is of high complexity and the impact is availability-only, but the resulting denial of service is permanent and non-recoverable without a reboot. The fix releases the buffer with airoc_wifi_buffer_release() on the failure branch, returning it to the pool. The commit also removes a redundant k_sem_give() in airoc_mgmt_disconnect(); because data->sema_common is a binary semaphore (limit 1) the duplicate give merely saturated at 1 and had no security impact.
INFO
Published Date :
Aug. 22, 2026, 9:16 p.m.
Last Modified :
Oct. 12, 2026, 4:10 p.m.
Remotely Exploit :
No
Source :
[email protected]
Affected Products
The following products are affected by CVE-2026-12999
vulnerability.
Even if cvefeed.io is aware of the exact versions of the
products
that
are
affected, the information is not represented in the table below.
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | |||||
| CVSS 3.1 | MEDIUM | e2e69745-5e70-4e92-8431-deb5529a81ad | ||||
| CVSS 3.1 | MEDIUM | [email protected] | ||||
| CVSS 3.1 | MEDIUM | MITRE-CVE |
Solution
- Update the Infineon Airoc Wi-Fi driver.
- Apply the specific patch for buffer leak.
- Test Wi-Fi connectivity after update.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-12999.
| URL | Resource |
|---|---|
| https://github.com/zephyrproject-rtos/zephyr/commit/4e6f624292ed153a762e98c7a297998c8d0b52c4 | |
| https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-8w97-ghfm-5wjp |
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-12999 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-12999
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-12999 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-12999 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Translated by [email protected]
Oct. 12, 2026
Action Type Old Value New Value Added Translation Title: zephyr de zephyrproject, Description: La función de devolución de llamada de transmisión del controlador Wi-Fi Infineon Airoc airoc_mgmt_send() en drivers/wifi/infineon/airoc_wifi.c asigna un net_buf del airoc_pool fijo para cada paquete saliente. Cuando whd_network_send_ethernet_data() devuelve un fallo síncrono, la biblioteca WHD subyacente no toma posesión del búfer, pero el controlador anterior a la corrección devolvió -EIO sin liberarlo. Cada transmisión fallida, por lo tanto, fuga permanentemente un búfer del pool. airoc_pool es pequeño y fijo (AIROC_WIFI_TX_PACKET_POOL_COUNT + AIROC_WIFI_RX_PACKET_POOL_COUNT, 20 búferes por defecto) y es compartido por la función de devolución de llamada whd_host_buffer_get de WHD tanto para transmisión como para recepción. Una vez que suficientes fallos de envío han vaciado el pool por fuga, airoc_wifi_host_buffer_get() devuelve WHD_BUFFER_ALLOC_FAIL para todas las asignaciones subsiguientes, por lo que tanto la transmisión como la ruta de recepción impulsada por WHD fallan y la conectividad Wi-Fi se pierde hasta que el dispositivo se reinicia. La fuga ocurre solo en la ruta de error de transmisión. Un atacante adyacente a Wi-Fi puede influir en las condiciones que causan fallos de envío síncronos (por ejemplo, desautenticando/desasociando la estación mientras la pila local continúa intentando transmisiones), y los fallos transitorios ordinarios durante la vida útil del dispositivo se acumulan hacia el mismo estado. El desencadenamiento fiable bajo demanda es de alta complejidad y el impacto es solo de disponibilidad, pero la denegación de servicio resultante es permanente e irrecuperable sin un reinicio. La corrección libera el búfer con airoc_wifi_buffer_release() en la rama de fallo, devolviéndolo al pool. El commit también elimina un k_sem_give() redundante en airoc_mgmt_disconnect(); debido a que data -> sema_common es un semáforo binario (límite 1), la entrega duplicada simplemente se saturó en 1 y no tuvo impacto en la seguridad. -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Aug. 25, 2026
Action Type Old Value New Value Added SSVC {'id': 'CVE-2026-12999', 'role': 'CISA Coordinator', 'options': [{'exploitation': 'none'}, {'automatable': 'no'}, {'technicalImpact': 'partial'}], 'version': '2.0.3', 'timestamp': '2026-08-25T19:07:13.318585Z'} -
New CVE Received by [email protected]
Aug. 22, 2026
Action Type Old Value New Value Added Affected [{'vendor': 'zephyrproject', 'product': 'zephyr', 'versions': [{'status': 'affected', 'version': '3.6.0', 'lessThan': '4.4.2', 'versionType': 'semver'}], 'packageName': 'zephyr', 'programFiles': ['drivers/wifi/infineon/airoc_wifi.c'], 'collectionURL': 'https://github.com/zephyrproject-rtos/zephyr', 'defaultStatus': 'unaffected'}] Added Description The Infineon Airoc Wi-Fi driver's transmit callback airoc_mgmt_send() in drivers/wifi/infineon/airoc_wifi.c allocates a net_buf from the fixed airoc_pool for every outbound packet. When whd_network_send_ethernet_data() returns a synchronous failure, the underlying WHD library does not take ownership of the buffer, but the pre-fix driver returned -EIO without releasing it. Each failed transmit therefore permanently leaks one buffer from the pool. airoc_pool is small and fixed (AIROC_WIFI_TX_PACKET_POOL_COUNT + AIROC_WIFI_RX_PACKET_POOL_COUNT, default 20 buffers) and is shared by WHD's whd_host_buffer_get callback for both transmit and receive. Once enough send failures have leaked the pool dry, airoc_wifi_host_buffer_get() returns WHD_BUFFER_ALLOC_FAIL for all subsequent allocations, so both transmit and the WHD-driven receive path fail and Wi-Fi connectivity is lost until the device is rebooted. The leak occurs only on the transmit error path. A Wi-Fi-adjacent attacker can influence the conditions that cause synchronous send failures (for example by deauthenticating/disassociating the station while the local stack continues to attempt transmits), and ordinary transient failures over the device's lifetime accumulate toward the same state. Reliable on-demand triggering is of high complexity and the impact is availability-only, but the resulting denial of service is permanent and non-recoverable without a reboot. The fix releases the buffer with airoc_wifi_buffer_release() on the failure branch, returning it to the pool. The commit also removes a redundant k_sem_give() in airoc_mgmt_disconnect(); because data->sema_common is a binary semaphore (limit 1) the duplicate give merely saturated at 1 and had no security impact. Added CVSS V3.1 AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H Added CWE CWE-401 Added Reference https://github.com/zephyrproject-rtos/zephyr/commit/4e6f624292ed153a762e98c7a297998c8d0b52c4 Added Reference https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-8w97-ghfm-5wjp