Executive brief
The Infineon Airoc Wi-Fi driver contains a memory leak in its transmit function that causes Wi-Fi connectivity to fail permanently. When packet transmission fails, the driver fails to release allocated buffers, gradually exhausting a small fixed pool shared by both transmit and receive operations. An attacker in Wi-Fi range can trigger repeated failures to accelerate pool depletion, causing Wi-Fi to stop working until the device is rebooted.
Technical details
The vulnerability is a resource leak in the airoc_mgmt_send() transmit callback in drivers/wifi/infineon/airoc_wifi.c. When whd_network_send_ethernet_data() returns a synchronous failure, the driver returns -EIO without releasing the allocated net_buf back to the fixed airoc_pool buffer pool. The pool is shared by WHD's buffer allocation callback for both transmit and receive paths and defaults to only 20 buffers total. Repeated transmit failures cause permanent pool exhaustion; once depleted, airoc_wifi_host_buffer_get() returns WHD_BUFFER_ALLOC_FAIL for all allocations, breaking both transmit and receive operations until reboot. A Wi-Fi-adjacent attacker can influence failure conditions (e.g., deauthentication) to accelerate exhaustion, though on-demand triggering is complex. The fix adds airoc_wifi_buffer_release() on the failure path to return the buffer to the pool.
Affected products
- Infineon Airoc Wi-Fi driver
Timeline
- 2026-08-22: disclosed