CVE-2026-12999 - Infineon Airoc Wi-Fi driver leaks TX buffers on send failure, leading to permanent pool exhaustion
Brief
CVE ID : CVE-2026-12999
Published : Aug. 22, 2026, 8:35 p. m.
- 35 minutes ago
Description : The Infineon Airoc Wi-Fi driver's transmit callback airoc_mgmt_send() in drivers/wifi/infineon/airoc_wifi. c allocates a net_buf from the fixed airoc_pool for every outbound packet. When whd_network_send_ethernet_data() returns a synchronous failure, the underlying WHD library does not take ownership of the buffer, but the pre-fix driver returned -EIO without releasing it.
Each failed transmit therefore permanently leaks one buffer from the pool.
airoc_pool is small and fixed (AIROC_WIFI_TX_PACKET_POOL_COUNT + AIROC_WIFI_RX_PACKET_POOL_COUNT, default 20 buffers) and is shared by WHD's whd_host_buffer_get callback for both transmit and receive.