CVE-2026-12999

Name of the Vulnerable Software and Affected Versions Infineon Airoc Wi-Fi driver (affected versions not specified)

Description A memory leak exists in the transmit callback airoc mgmt send() within the drivers/wifi/infineon/airoc wifi.c file. The driver allocates a net buf from a fixed pool called airoc pool for every outbound packet. If the function whd network send ethernet data() returns a synchronous failure, the driver fails to release the buffer, causing a permanent leak. Because the airoc pool is small and shared between transmit and receive paths, sufficient failures will exhaust the pool, leading airoc wifi host buffer get() to return WHD BUFFER ALLOC FAIL. This results in a permanent denial of service where Wi-Fi connectivity is lost and cannot be recovered without a device reboot. A Wi-Fi-adjacent attacker could potentially trigger this by forcing synchronous send failures, such as by deauthenticating or disassociating the station.

Recommendations Update the driver to a version where the airoc mgmt send() function is patched to release the buffer using airoc wifi buffer release() on the failure branch.