The Infineon Airoc Wi-Fi driver's transmit callback airoc_mgmt_send() allocates buffers from a fixed pool for outbound packets. On synchronous transmit failures returned by whd_network_send_ethernet_data(), the driver previously returned an error without releasing the allocated buffer, causing a permanent leak. The buffer pool is small and shared for both transmit and receive operations. When the pool is exhausted due to leaked buffers, subsequent allocations fail, causing both transmit and receive paths to fail and resulting in loss of Wi-Fi connectivity until device reboot. The leak occurs only on the transmit error path and can be influenced by Wi-Fi-adjacent attackers through conditions causing send failures, such as deauthentication. The fix involves releasing the buffer on failure to prevent leaks. A redundant semaphore release was also removed but had no security impact.

The vulnerability causes a denial of service by permanently leaking buffers from a fixed-size pool on transmit failures, leading to exhaustion of the pool. This results in loss of Wi-Fi connectivity as both transmit and receive operations fail until the device is rebooted. There is no impact on confidentiality or integrity. The denial of service is availability-only and requires a reboot to recover.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The described fix involves releasing leaked buffers on transmit failure to prevent exhaustion of the buffer pool. Until a fix is applied, mitigating conditions that cause synchronous send failures may reduce risk but cannot fully prevent the denial of service. A device reboot is required to recover from the denial of service once the buffer pool is exhausted.