Zephyr RTOS CVE-2026-14366

The target must be running Zephyr RTOS with the SiWx917 WiFi driver built with CONFIG_WIFI_SILABS_SIWX91X_NET_STACK_NATIVE enabled - this is the default configuration for SiWx917 board targets, so no non-default operator configuration is required. The attacker must be on the same WiFi Layer 2 segment as the target (WiFi association to the same BSS or access point) to send packets that elicit outbound transmissions; remote internet-based attackers cannot reach this code path. Valid trigger mechanisms include ARP requests (eliciting ARP replies), ICMP echo requests (eliciting echo replies), and TCP SYN packets (eliciting SYN-ACK responses). Successful pool corruption additionally depends on winning a timing race between concurrent network pool activity and the double-free, corresponding to CVSS AC:H - reliable triggering is non-trivial and not deterministic per packet. Exploitation is bounded by: (1) mandatory WiFi Layer 2 adjacency, (2) the race condition dependency, and (3) the niche embedded deployment footprint of Zephyr/SiWx917 hardware.

The CVSS 3.1 score of 6.4 (Medium) with AV:A/AC:H accurately reflects the exploitation constraints: the attacker must share Layer 2 WiFi adjacency with the target and must also win a timing race against concurrent pool activity, which together suppress the practical exploitation rate below what the availability impact alone might suggest. No EPSS score was provided in the intelligence inputs; absent that signal, the high-complexity race condition and the narrow embedded hardware deployment context indicate targeted rather than opportunistic exploitation risk. No KEV listing and no public exploit code have been identified at time of analysis. That said, the operational severity for affected deployments is real: availability loss in IoT edge nodes, industrial controllers, or networked embedded systems running Zephyr with SiWx917 hardware can be mission-critical, and the vulnerability is active in the default build configuration requiring no operator misconfiguration to be present. The secondary C:L and I:L signals represent race-dependent possibilities - pool content disclosure or in-flight packet integrity corruption - that are plausible but not guaranteed per transmission. The patch is a trivial one-line change with minimal regression risk, making the remediation cost extremely low relative to the residual exposure.

An attacker authenticated to the same WiFi access point as a Zephyr/SiWx917 embedded device sends a stream of ARP requests and ICMP echo requests to the device's IP address, inducing repeated outbound ARP replies and ICMP replies. Each reply traverses the siwx91x_send() double-free path; when a concurrent receive interrupt recycles the freed net_pkt slab slot between the driver's unref and the caller's unref, the second unref corrupts a live packet's reference count, ultimately hanging or crashing the networking stack. No public exploit code has been identified at time of analysis.