CVE-2026-12999

{
  "id": "CVE-2026-12999",
  "sourceIdentifier": "[email protected]",
  "published": "2026-08-22T21:16:48.747",
  "lastModified": "2026-11-04T05:18:41.007",
  "vulnStatus": "Awaiting Analysis",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "The Infineon Airoc Wi-Fi driver's transmit callback airoc_mgmt_send() in drivers/wifi/infineon/airoc_wifi.c allocates a net_buf from the fixed airoc_pool for every outbound packet. When whd_network_send_ethernet_data() returns a synchronous failure, the underlying WHD library does not take ownership of the buffer, but the pre-fix driver returned -EIO without releasing it. Each failed transmit therefore permanently leaks one buffer from the pool.\n\nairoc_pool is small and fixed (AIROC_WIFI_TX_PACKET_POOL_COUNT + AIROC_WIFI_RX_PACKET_POOL_COUNT, default 20 buffers) and is shared by WHD's whd_host_buffer_get callback for both transmit and receive. Once enough send failures have leaked the pool dry, airoc_wifi_host_buffer_get() returns WHD_BUFFER_ALLOC_FAIL for all subsequent allocations, so both transmit and the WHD-driven receive path fail and Wi-Fi connectivity is lost until the device is rebooted.\n\nThe leak occurs only on the transmit error path. A Wi-Fi-adjacent attacker can influence the conditions that cause synchronous send failures (for example by deauthenticating/disassociating the station while the local stack continues to attempt transmits), and ordinary transient failures over the device's lifetime accumulate toward the same state. Reliable on-demand triggering is of high complexity and the impact is availability-only, but the resulting denial of service is permanent and non-recoverable without a reboot.\n\nThe fix releases the buffer with airoc_wifi_buffer_release() on the failure branch, returning it to the pool. The commit also removes a redundant k_sem_give() in airoc_mgmt_disconnect(); because data->sema_common is a binary semaphore (limit 1) the duplicate give merely saturated at 1 and had no security impact."
    },
    {
      "lang": "es",
      "value": "La función de devolución de llamada de transmisión del controlador Wi-Fi Infineon Airoc airoc_mgmt_send() en drivers/wifi/infineon/airoc_wifi.c asigna un net_buf del airoc_pool fijo para cada paquete saliente. Cuando whd_network_send_ethernet_data() devuelve un fallo síncrono, la biblioteca WHD subyacente no toma posesión del búfer, pero el controlador anterior a la corrección devolvió -EIO sin liberarlo. Cada transmisión fallida, por lo tanto, fuga permanentemente un búfer del pool.\n\nairoc_pool es pequeño y fijo (AIROC_WIFI_TX_PACKET_POOL_COUNT + AIROC_WIFI_RX_PACKET_POOL_COUNT, 20 búferes por defecto) y es compartido por la función de devolución de llamada whd_host_buffer_get de WHD tanto para transmisión como para recepción. Una vez que suficientes fallos de envío han vaciado el pool por fuga, airoc_wifi_host_buffer_get() devuelve WHD_BUFFER_ALLOC_FAIL para todas las asignaciones subsiguientes, por lo que tanto la transmisión como la ruta de recepción impulsada por WHD fallan y la conectividad Wi-Fi se pierde hasta que el dispositivo se reinicia.\n\nLa fuga ocurre solo en la ruta de error de transmisión. Un atacante adyacente a Wi-Fi puede influir en las condiciones que causan fallos de envío síncronos (por ejemplo, desautenticando/desasociando la estación mientras la pila local continúa intentando transmisiones), y los fallos transitorios ordinarios durante la vida útil del dispositivo se acumulan hacia el mismo estado. El desencadenamiento fiable bajo demanda es de alta complejidad y el impacto es solo de disponibilidad, pero la denegación de servicio resultante es permanente e irrecuperable sin un reinicio.\n\nLa corrección libera el búfer con airoc_wifi_buffer_release() en la rama de fallo, devolviéndolo al pool. El commit también elimina un k_sem_give() redundante en airoc_mgmt_disconnect(); debido a que data -> sema_common es un semáforo binario (límite 1), la entrega duplicada simplemente se saturó en 1 y no tuvo impacto en la seguridad."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "zephyrproject",
          "product": "zephyr",
          "defaultStatus": "unaffected",
          "collectionURL": "https://github.com/zephyrproject-rtos/zephyr",
          "packageName": "zephyr",
          "programFiles": [
            "drivers/wifi/infineon/airoc_wifi.c"
          ],
          "versions": [
            {
              "version": "3.6.0",
              "lessThan": "4.3.2",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "4.4.0",
              "lessThan": "4.4.2",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "baseScore": 5.3,
          "baseSeverity": "MEDIUM",
          "attackVector": "ADJACENT_NETWORK",
          "attackComplexity": "HIGH",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 1.6,
        "impactScore": 3.6
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-08-25T19:07:13.318585Z",
          "id": "CVE-2026-12999",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-401"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/zephyrproject-rtos/zephyr/commit/4e6f624292ed153a762e98c7a297998c8d0b52c4",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-8w97-ghfm-5wjp",
      "source": "[email protected]"
    }
  ]
}