Is CVE-2026-14366 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-14366 being exploited in the wild.

How severe is CVE-2026-14366?

Medium severity, with a CVSS score of 6.4, published 31 August 2026.

Which products and versions are affected?

Silicon Labs SiWx917 WiFi Driver Zephyr builds with CONFIG_WIFI_SILABS_SIWX91X_NET_STACK_NATIVE enabled (default).

Is there a fix for CVE-2026-14366?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-14366 attacked?

It is attacked from the adjacent network.

Am I affected by CVE-2026-14366?

Check whether you run Silicon Labs SiWx917 WiFi Driver at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-14366: Silicon Labs SiWx917 WiFi driver double-free in transmit callback

CVE-2026-14366 · Severity: medium · CVSS 6.4 · Published 2026-08-31

The Silicon Labs SiWx917 WiFi driver contains a memory management bug in its packet transmission code that incorrectly frees network packets owned by the operating system's networking stack. An attacker on the same WiFi network can trigger repeated packet transmissions (via ARP, ICMP, or TCP traffic), causing the shared memory pool to become corrupted and leading to network hangs, system crashes, and loss of network availability.

Vendors: Silicon Labs.

Quick answers

Is CVE-2026-14366 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-14366 being exploited in the wild.
How severe is CVE-2026-14366?: Medium severity, with a CVSS score of 6.4, published 31 August 2026.
Which products and versions are affected?: Silicon Labs SiWx917 WiFi Driver Zephyr builds with CONFIG_WIFI_SILABS_SIWX91X_NET_STACK_NATIVE enabled (default).
Is there a fix for CVE-2026-14366?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-14366 attacked?: It is attacked from the adjacent network.
Am I affected by CVE-2026-14366?: Check whether you run Silicon Labs SiWx917 WiFi Driver at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a use-after-free and double-free bug in the siwx91x_send() transmit callback function (drivers/wifi/siwx91x/siwx91x_wifi.c). The driver incorrectly calls net_pkt_unref() on a packet it does not own—the packet is owned by the Zephyr networking stack and only borrowed by the driver for copying frame bytes. After the driver unrefs the packet prematurely, the caller (ethernet_send() in subsys/net/l2/ethernet/ethernet.c) attempts to read packet metadata and unref it again, resulting in use-after-free reads and a double-free condition. Concurrent network activity can cause the freed slab to be recycled, corrupting the reference count of a different live packet in the shared networking buffer pool. The vulnerability is triggered by ordinary transmissions on the native-stack SiWx917 WiFi interface and can be induced by an adjacent attacker sending ARP requests, ICMP pings, or TCP handshakes. The fix is to remove the erroneous net_pkt_unref() call from the driver's transmit path.

Affected products

Silicon Labs SiWx917 WiFi Driver Zephyr builds with CONFIG_WIFI_SILABS_SIWX91X_NET_STACK_NATIVE enabled (default)

Timeline

2026-08-31: disclosed: Vulnerability published to NVD

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.