Executive brief
The Silicon Labs SiWx917 WiFi driver contains a memory management bug in its packet transmission code that incorrectly frees network packets owned by the operating system's networking stack. An attacker on the same WiFi network can trigger repeated packet transmissions (via ARP, ICMP, or TCP traffic), causing the shared memory pool to become corrupted and leading to network hangs, system crashes, and loss of network availability.
Technical details
The vulnerability is a use-after-free and double-free bug in the siwx91x_send() transmit callback function (drivers/wifi/siwx91x/siwx91x_wifi.c). The driver incorrectly calls net_pkt_unref() on a packet it does not own—the packet is owned by the Zephyr networking stack and only borrowed by the driver for copying frame bytes. After the driver unrefs the packet prematurely, the caller (ethernet_send() in subsys/net/l2/ethernet/ethernet.c) attempts to read packet metadata and unref it again, resulting in use-after-free reads and a double-free condition. Concurrent network activity can cause the freed slab to be recycled, corrupting the reference count of a different live packet in the shared networking buffer pool. The vulnerability is triggered by ordinary transmissions on the native-stack SiWx917 WiFi interface and can be induced by an adjacent attacker sending ARP requests, ICMP pings, or TCP handshakes. The fix is to remove the erroneous net_pkt_unref() call from the driver's transmit path.
Affected products
- Silicon Labs SiWx917 WiFi Driver Zephyr builds with CONFIG_WIFI_SILABS_SIWX91X_NET_STACK_NATIVE enabled (default)
Timeline
- 2026-08-31: disclosed: Vulnerability published to NVD