Memory Corruption Vulnerability in SiWx917 WiFi Driver by Silicon Labs

CVE-2026-14366

What is CVE-2026-14366?

The SiWx917 WiFi driver contains a vulnerability where a network packet is improperly freed, leading to potential memory corruption and system instability. The issue arises in the siwx91x_send() function, which incorrectly calls net_pkt_unref() on a packet it does not own. This can cause use-after-free scenarios, resulting in a crash or mismanagement of the network buffer pool. Attackers on the same WiFi network may exploit this vulnerability through techniques that induce traffic, causing the system to hang or crash. Corrective measures have been implemented in recent patches to address this issue.

References