Description

The Infineon Airoc Wi-Fi driver's transmit callback airoc_mgmt_send() in drivers/wifi/infineon/airoc_wifi.c allocates a net_buf from the fixed airoc_pool for every outbound packet. When whd_network_send_ethernet_data() returns a synchronous failure, the underlying WHD library does not take ownership of the buffer, but the pre-fix driver returned -EIO without releasing it. Each failed transmit therefore permanently leaks one buffer from the pool. airoc_pool is small and fixed (AIROC_WIFI_TX_PACKET_POOL_COUNT + AIROC_WIFI_RX_PACKET_POOL_COUNT, default 20 buffers) and is shared by WHD's whd_host_buffer_get callback for both transmit and receive. Once enough send failures have leaked the pool dry, airoc_wifi_host_buffer_get() returns WHD_BUFFER_ALLOC_FAIL for all subsequent allocations, so both transmit and the WHD-driven receive path fail and Wi-Fi connectivity is lost until the device is rebooted. The leak occurs only on the transmit error path. A Wi-Fi-adjacent attacker can influence the conditions that cause synchronous send failures (for example by deauthenticating/disassociating the station while the local stack continues to attempt transmits), and ordinary transient failures over the device's lifetime accumulate toward the same state. Reliable on-demand triggering is of high complexity and the impact is availability-only, but the resulting denial of service is permanent and non-recoverable without a reboot. The fix releases the buffer with airoc_wifi_buffer_release() on the failure branch, returning it to the pool. The commit also removes a redundant k_sem_give() in airoc_mgmt_disconnect(); because data->sema_common is a binary semaphore (limit 1) the duplicate give merely saturated at 1 and had no security impact.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-08-22T21:16:48.747Z",
  "pubdate": "2026-08-22T21:16:48.747Z",
  "executiveSummary": "An information technology vulnerability exists in the Infineon Airoc Wi-Fi driver, specifically within the transmit callback function airoc_mgmt_send() located in drivers/wifi/infineon/airoc_wifi.c.\nThe vulnerability is characterized by a memory leak of network buffers (net_buf) allocated from the fixed airoc_pool, leading to a permanent denial of service affecting system availability.\nThe affected product is the Infineon Airoc Wi-Fi driver utilizing the WHD library across systems sharing the fixed transmit and receive buffer pool.\nThe risk implications involve complete and permanent loss of Wi-Fi connectivity requiring a device reboot to recover.\nAn attacker positioned adjacent to the Wi-Fi network can influence conditions causing synchronous send failures, such as by transmitting deauthentication or disassociation frames while the local stack attempts outgoing transmissions.\nExploitation requires Wi-Fi adjacency to induce send failures, though transient network conditions can also naturally accumulate toward the same resource exhaustion state over the device's operational lifetime.",
  "technicalDetails": "The vulnerability resides in the transmit error handling path of the Infineon Airoc Wi-Fi driver implemented in drivers/wifi/infineon/airoc_wifi.c.\nDuring outbound packet transmission, airoc_mgmt_send() allocates a net_buf from the fixed airoc_pool.\nWhen whd_network_send_ethernet_data() encounters a synchronous failure, the underlying WHD library fails to take ownership of the buffer.\nIn the vulnerable implementation, the driver returns -EIO without releasing the allocated buffer back to the pool, resulting in a permanent memory leak of one buffer per failed transmission.\nThe airoc_pool is a fixed and small resource allocation defined by AIROC_WIFI_TX_PACKET_POOL_COUNT and AIROC_WIFI_RX_PACKET_POOL_COUNT, defaulting to a total of 20 buffers shared by WHD's whd_host_buffer_get callback for both transmit and receive operations.\nAs send failures accumulate, the pool is eventually exhausted.\nOnce the pool is depleted, subsequent calls to airoc_wifi_host_buffer_get() return WHD_BUFFER_ALLOC_FAIL.\nThis resource exhaustion causes both the transmit path and the WHD-driven receive path to fail entirely, resulting in complete loss of Wi-Fi connectivity that cannot be recovered without restarting the device.\nA Wi-Fi-adjacent attacker can actively facilitate this exhaustion attack flow by repeatedly forcing disassociations or deauthentications while the local stack attempts continuous outbound transmission.\nIn addition to malicious triggering, normal operational transient failures over time will naturally consume the pool buffers, eventually causing the same denial of service condition."
}