CVE-2026-12999: Infineon Airoc Wi-Fi driver leaks TX buffers on send failure, leading to permanent pool exhaustion
The Infineon Airoc Wi-Fi driver's transmit callback airocmgmtsend() in drivers/wifi/infineon/airocwifi.c allocates a netbuf from the fixed airocpool for every outbound packet. When whdnetworksendethernetdata() returns a synchronous failure, the underlying WHD library does not take ownership of the buffer, but the pre-fix driver returned -EIO without releasing it. Each failed transmit therefore permanently leaks one buffer from the pool.
airocpool is small and fixed (AIROCWIFITXPACKETPOOLCOUNT + AIROCWIFIRXPACKETPOOLCOUNT, default 20 buffers) and is shared by WHD's whdhostbufferget callback for both transmit and receive. Once enough send failures have leaked the pool dry, airocwifihostbufferget() returns WHDBUFFERALLOCFAIL for all subsequent allocations, so both transmit and the WHD-driven receive path fail and Wi-Fi connectivity is lost until the device is rebooted.
The leak occurs only on the transmit error path. A Wi-Fi-adjacent attacker can influence the conditions that cause synchronous send failures (for example by deauthenticating/disassociating the station while the local stack continues to attempt transmits), and ordinary transient failures over the device's lifetime accumulate toward the same state. Reliable on-demand triggering is of high complexity and the impact is availability-only, but the resulting denial of service is permanent and non-recoverable without a reboot.
The fix releases the buffer with airocwifibufferrelease() on the failure branch, returning it to the pool. The commit also removes a redundant ksemgive() in airocmgmtdisconnect(); because data->semacommon is a binary semaphore (limit 1) the duplicate give merely saturated at 1 and had no security impact.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
In drivers/wifi/infineon/airoc_wifi.c, in airoc_mgmt_send() after allocating a net_buf from the fixed airoc_pool, ensure that on the failure branch where whd_network_send_ethernet_data() returns a synchronous failure (e.g., driver returns -EIO), the driver calls airoc_wifi_buffer_release() to return the buffer to the pool. (The underlying WHD library does not take ownership on synchronous failure, so ownership must be handled by the driver.)
Infineon Airoc Wi-Fi driver (airoc_wifi.c) TX error path handling for management sends = Release allocated net_buf on synchronous transmit failure - Operational
Because pool exhaustion requires a reboot to restore Wi-Fi connectivity (“non-recoverable without a reboot”), reboot the device after persistent WHD_BUFFER_ALLOC_FAIL/failed transmit or receive allocations indicate the airoc_pool has been drained.
Event History
Frequently Asked Questions
Which deployments are exposed to practical denial of service?
Devices using the Infineon Airoc Wi-Fi driver are exposed when they continue attempting outbound traffic during synchronous transmit failures. The default shared buffer pool contains 20 buffers, so repeated failures can exhaust it quickly.
What does an attacker need to do to trigger the issue?
The attacker needs to be Wi-Fi-adjacent and able to influence conditions that cause synchronous transmit failures, such as deauthenticating or disassociating a station while the device continues transmitting. No privileges or user interaction are required.
How can an operator recognize that the pool has been exhausted?
After sufficient failed sends, both transmission and WHD-driven receive allocations fail, resulting in loss of Wi-Fi connectivity. Connectivity remains unavailable until the device is rebooted.