CVE-2026-12999

{"id": "CVE-2026-12999", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-12999", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-25T19:07:13.318585Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "vulnerabilities@zephyrproject.org", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 1.6}]}, "affected": [{"source": "vulnerabilities@zephyrproject.org", "affectedData": [{"vendor": "zephyrproject", "product": "zephyr", "versions": [{"status": "affected", "version": "3.6.0", "lessThan": "4.4.2", "versionType": "semver"}], "packageName": "zephyr", "programFiles": ["drivers/wifi/infineon/airoc_wifi.c"], "collectionURL": "https://github.com/zephyrproject-rtos/zephyr", "defaultStatus": "unaffected"}]}], "published": "2026-08-22T21:16:48.747", "references": [{"url": "https://github.com/zephyrproject-rtos/zephyr/commit/4e6f624292ed153a762e98c7a297998c8d0b52c4", "source": "vulnerabilities@zephyrproject.org"}, {"url": "https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-8w97-ghfm-5wjp", "source": "vulnerabilities@zephyrproject.org"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "vulnerabilities@zephyrproject.org", "description": [{"lang": "en", "value": "CWE-401"}]}], "descriptions": [{"lang": "en", "value": "The Infineon Airoc Wi-Fi driver's transmit callback airoc_mgmt_send() in drivers/wifi/infineon/airoc_wifi.c allocates a net_buf from the fixed airoc_pool for every outbound packet. When whd_network_send_ethernet_data() returns a synchronous failure, the underlying WHD library does not take ownership of the buffer, but the pre-fix driver returned -EIO without releasing it. Each failed transmit therefore permanently leaks one buffer from the pool.\n\nairoc_pool is small and fixed (AIROC_WIFI_TX_PACKET_POOL_COUNT + AIROC_WIFI_RX_PACKET_POOL_COUNT, default 20 buffers) and is shared by WHD's whd_host_buffer_get callback for both transmit and receive. Once enough send failures have leaked the pool dry, airoc_wifi_host_buffer_get() returns WHD_BUFFER_ALLOC_FAIL for all subsequent allocations, so both transmit and the WHD-driven receive path fail and Wi-Fi connectivity is lost until the device is rebooted.\n\nThe leak occurs only on the transmit error path. A Wi-Fi-adjacent attacker can influence the conditions that cause synchronous send failures (for example by deauthenticating/disassociating the station while the local stack continues to attempt transmits), and ordinary transient failures over the device's lifetime accumulate toward the same state. Reliable on-demand triggering is of high complexity and the impact is availability-only, but the resulting denial of service is permanent and non-recoverable without a reboot.\n\nThe fix releases the buffer with airoc_wifi_buffer_release() on the failure branch, returning it to the pool. The commit also removes a redundant k_sem_give() in airoc_mgmt_disconnect(); because data->sema_common is a binary semaphore (limit 1) the duplicate give merely saturated at 1 and had no security impact."}, {"lang": "es", "value": "La funci\u00f3n de devoluci\u00f3n de llamada de transmisi\u00f3n del controlador Wi-Fi Infineon Airoc airoc_mgmt_send() en drivers/wifi/infineon/airoc_wifi.c asigna un net_buf del airoc_pool fijo para cada paquete saliente. Cuando whd_network_send_ethernet_data() devuelve un fallo s\u00edncrono, la biblioteca WHD subyacente no toma posesi\u00f3n del b\u00fafer, pero el controlador anterior a la correcci\u00f3n devolvi\u00f3 -EIO sin liberarlo. Cada transmisi\u00f3n fallida, por lo tanto, fuga permanentemente un b\u00fafer del pool.\n\nairoc_pool es peque\u00f1o y fijo (AIROC_WIFI_TX_PACKET_POOL_COUNT + AIROC_WIFI_RX_PACKET_POOL_COUNT, 20 b\u00faferes por defecto) y es compartido por la funci\u00f3n de devoluci\u00f3n de llamada whd_host_buffer_get de WHD tanto para transmisi\u00f3n como para recepci\u00f3n. Una vez que suficientes fallos de env\u00edo han vaciado el pool por fuga, airoc_wifi_host_buffer_get() devuelve WHD_BUFFER_ALLOC_FAIL para todas las asignaciones subsiguientes, por lo que tanto la transmisi\u00f3n como la ruta de recepci\u00f3n impulsada por WHD fallan y la conectividad Wi-Fi se pierde hasta que el dispositivo se reinicia.\n\nLa fuga ocurre solo en la ruta de error de transmisi\u00f3n. Un atacante adyacente a Wi-Fi puede influir en las condiciones que causan fallos de env\u00edo s\u00edncronos (por ejemplo, desautenticando/desasociando la estaci\u00f3n mientras la pila local contin\u00faa intentando transmisiones), y los fallos transitorios ordinarios durante la vida \u00fatil del dispositivo se acumulan hacia el mismo estado. El desencadenamiento fiable bajo demanda es de alta complejidad y el impacto es solo de disponibilidad, pero la denegaci\u00f3n de servicio resultante es permanente e irrecuperable sin un reinicio.\n\nLa correcci\u00f3n libera el b\u00fafer con airoc_wifi_buffer_release() en la rama de fallo, devolvi\u00e9ndolo al pool. El commit tambi\u00e9n elimina un k_sem_give() redundante en airoc_mgmt_disconnect(); debido a que data -> sema_common es un sem\u00e1foro binario (l\u00edmite 1), la entrega duplicada simplemente se satur\u00f3 en 1 y no tuvo impacto en la seguridad."}], "lastModified": "2026-10-12T16:10:00.220", "sourceIdentifier": "vulnerabilities@zephyrproject.org"}