CVE-2026-14366

Name of the Vulnerable Software and Affected Versions Silicon Labs SiWx917 WiFi driver (affected versions not specified)

Description The transmit callback function siwx91x send() in the WiFi driver incorrectly releases a network packet owned by the L2 networking stack. This occurs when the CONFIG WIFI SILABS SIWX91X NET STACK NATIVE configuration is enabled. The function calls net pkt unref(pkt) prematurely, returning the packet to the shared pool while the caller, ethernet send(), still intends to use it. This sequence leads to use-after-free reads and a double free. If concurrent network activity recycles the memory slot, the second release may affect a different active packet, resulting in corruption of the kernel networking buffer pool. An adjacent attacker on the same network can trigger this by inducing transmissions such as ARP, ICMP echo replies, or TCP handshakes, potentially causing transmit hangs, system crashes, or memory corruption.

Recommendations Remove the erroneous net pkt unref(pkt) call from the siwx91x send() function.