{"answers":{"affected":"","exploited":"There is no known exploitation of CVE-2026-12999 in the wild and no public exploit code.","fix":"No fix has been published for CVE-2026-12999 yet. Limit exposure of the affected software until one is available.","what":"CVE-2026-12999 is a medium-severity denial of service vulnerability in zephyrproject zephyr, published on 22 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-12999 and fix it if it is affected.\n\nWhat it is: CVE-2026-12999 is a medium-severity denial of service vulnerability in zephyrproject zephyr, published on 22 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2026-12999 in the wild and no public exploit code.\n\nAffected product: zephyrproject zephyr. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-12999/ (Markdown: https://insights.sbomify.com/CVE-2026-12999/index.md)","id":"CVE-2026-12999","markdown":"https://insights.sbomify.com/CVE-2026-12999/index.md","name":"CVE-2026-12999","record":{"aliases":["GHSA-8w97-ghfm-5wjp"],"analysis":{"component_type":"operating_system","fix_type":"patch","impacts":["denial_of_service"],"network_reachable":"adjacent_or_local","non_default_config":false,"product_category":"Zephyr RTOS Wi-Fi driver","requires_auth":"none","summary":"A memory leak in the Infineon Airoc Wi-Fi driver allows attackers to exhaust transmit buffers, causing permanent Wi-Fi denial of service until reboot.","user_interaction":"not_required","vuln_class":"denial_of_service"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"zephyr","cpe":[],"cvss":{"score":5.3,"severity":"medium","source":"cna","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"cwes":[{"id":"CWE-401","name":"Missing Release of Memory after Effective Lifetime"}],"description":"The Infineon Airoc Wi-Fi driver's transmit callback airoc_mgmt_send() in drivers/wifi/infineon/airoc_wifi.c allocates a net_buf from the fixed airoc_pool for every outbound packet. When whd_network_send_ethernet_data() returns a synchronous failure, the underlying WHD library does not take ownership of the buffer, but the pre-fix driver returned -EIO without releasing it. Each failed transmit therefore permanently leaks one buffer from the pool.\n\nairoc_pool is small and fixed (AIROC_WIFI_TX_PACKET_POOL_COUNT + AIROC_WIFI_RX_PACKET_POOL_COUNT, default 20 buffers) and is shared by WHD's whd_host_buffer_get callback for both transmit and receive. Once enough send failures have leaked the pool dry, airoc_wifi_host_buffer_get() returns WHD_BUFFER_ALLOC_FAIL for all subsequent allocations, so both transmit and the WHD-driven receive path fail and Wi-Fi connectivity is lost until the device is rebooted.\n\nThe leak occurs only on the transmit error path. A Wi-Fi-adjacent attacker can influence the conditions that cause synchronous send failures (for example by deauthenticating/disassociating the station while the local stack continues to attempt transmits), and ordinary transient failures over the device's lifetime accumulate toward the same state. Reliable on-demand triggering is of high complexity and the impact is availability-only, but the resulting denial of service is permanent and non-recoverable without a reboot.\n\nThe fix releases the buffer with airoc_wifi_buffer_release() on the failure branch, returning it to the pool. The commit also removes a redundant k_sem_give() in airoc_mgmt_disconnect(); because data-\u003esema_common is a binary semaphore (limit 1) the duplicate give merely saturated at 1 and had no security impact.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":false,"headline":"Infineon Airoc Wi-Fi driver leaks TX buffers on send failure, leading to permanent pool exhaustion","id":"CVE-2026-12999","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"denial_of_service","year":"2026"},"n_packages":0,"n_references":2,"next":{"headline":"Podlove Podcast Publisher \u003c= 4.5.1 - Unauthenticated Arbitrary File Upload via podlove_image_cache_url Parameter","id":"CVE-2026-13001"},"packages":[],"prev":{"headline":"Information disclosure in Forminator Forms – Contact Form, Payment Form \u0026 Custom Form Builder","id":"CVE-2026-12998"},"products":["zephyr"],"published":"2026-08-22","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"no","exploitation":"none","technical_impact":"partial"},"state":"PUBLISHED","updated":"2026-08-25","vendors":["zephyrproject"]},"summary":"A memory leak in the Infineon Airoc Wi-Fi driver allows attackers to exhaust transmit buffers, causing permanent Wi-Fi denial of service until reboot.","url":"https://insights.sbomify.com/CVE-2026-12999/"}