CVE-2026-12999: dos in zephyrproject zephyr

The Infineon Airoc Wi-Fi driver's transmit callback airoc_mgmt_send() allocates a fixed pool buffer for each outbound packet. When the underlying WHD library's whd_network_send_ethernet_data() returns a synchronous failure, the pre-fix driver returns an error without releasing the allocated buffer, causing a permanent leak. The fixed buffer pool (default 20 buffers) is shared for transmit and receive. Once depleted, subsequent allocations fail, causing both transmit and receive paths to fail and resulting in permanent Wi-Fi loss until reboot. The leak occurs only on transmit error paths and can be influenced by Wi-Fi-adjacent attackers through deauthentication or disassociation attacks. The fix releases the buffer on failure, preventing the leak. Additionally, a redundant semaphore release was removed with no security impact.

The vulnerability causes a permanent denial of service by leaking network buffers on transmit failures, exhausting the fixed buffer pool and disabling Wi-Fi connectivity until the device is rebooted. There is no impact on confidentiality or integrity. Exploitation requires complex conditions such as inducing synchronous send failures, for example by deauthenticating the device. Ordinary transient failures can also accumulate to cause the issue over time. No known exploits are reported in the wild.

A fix is available that properly releases the allocated buffer on transmit failure, preventing the leak and subsequent denial of service. Users should upgrade to Zephyr version 4.4.2 or later where this issue is resolved. No additional mitigation is required as the vulnerability is patched in the fixed versions.