Zephyr RTOS CVE-2026-12999

The vulnerability is reachable only over Wi-Fi (AV:A) - the attacker must be within radio range of the target. The defect triggers exclusively on the transmit error path: whd_network_send_ethernet_data() must return a synchronous failure while the Zephyr network stack is actively attempting outbound transmits. Conditions that produce synchronous WHD failures include sudden loss of Wi-Fi association (e.g., forced deauthentication) while the application layer continues sending, or transient driver-level errors during RF instability. The device must be running Zephyr 3.6.0 through 4.4.1 with the Infineon AIROC Wi-Fi driver (CONFIG_WIFI_AIROC or equivalent Kconfig enabled). No authentication is required (PR:N). High attack complexity (AC:H) applies because reliably inducing repeated back-to-back synchronous failures requires maintaining a deauthentication state coincident with active host transmit attempts - a timing-sensitive, externally influenced condition. The pool exhaustion threshold is bounded (approximately 20 failures by default), which limits how quickly the DoS manifests under normal transient failure rates. Exploitation is confined entirely to availability; no confidentiality or integrity impact is possible through this path.

The CVSS 3.1 score of 5.3 Medium with vector AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H is well-calibrated to the actual threat. Adjacent-only reach (AV:A) confines the attack surface to devices within Wi-Fi radio range, and high attack complexity (AC:H) reflects the timing-sensitive requirement of inducing repeated synchronous WHD failures - the attacker must sustain deauthentication pressure while the host stack continues transmitting. EPSS data was not included in the provided intelligence, so probability of opportunistic exploitation cannot be quantified. The absence of a CISA KEV entry and absence of any reported POC confirm this is not being weaponized at scale. The primary real-world risk is organic: in adverse RF environments or during association instability, the leak accumulates without any attacker involvement, making this a latent reliability defect in addition to a security flaw. The impact, while limited to availability, is severe - the DoS is permanent and requires a full reboot to recover, which is significant in unattended embedded or industrial IoT deployments. Risk priority is moderate for most environments but elevated for Zephyr+AIROC deployments in remote or unattended scenarios.

An attacker within Wi-Fi radio range of an embedded Zephyr device running the AIROC driver repeatedly broadcasts 802.11 deauthentication or disassociation frames targeting the device, disrupting its Wi-Fi association while the device's network stack continues queuing and attempting outbound transmits. Each transmit attempt that returns a synchronous failure from WHD leaks one buffer from the 20-entry airoc_pool; after approximately 20 such failures, the pool is exhausted, and the device permanently loses all Wi-Fi connectivity - both TX and RX - until rebooted. No public exploit code exists, and the timing-sensitive nature of the attack (requiring simultaneous deauth pressure and active transmit attempts) means reliable triggering demands sustained, coordinated effort.