CVE-2026-64145
Received Received - Intake

Memory Leak in Linux Kernel WiFi Driver

Publication date: 2026-07-19

Last updated on: 2026-07-19

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: wifi: wilc1000: fix dma_buffer leak on bus acquire failure wilc_wlan_firmware_download() allocates dma_buffer with kmalloc() at the top of the function and uses a 'fail:' label to free it via kfree(dma_buffer) on error. All later error paths correctly use 'goto fail' to route through this cleanup. However, the early failure path after the first acquire_bus() call uses a bare 'return ret;', which leaks dma_buffer whenever the bus acquire fails. Replace the early return with goto fail so the existing cleanup path runs. Found via a custom Coccinelle semantic patch hunting for kmalloc'd locals leaked on early-return error paths in driver firmware-download code.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-19
Last Modified
2026-07-19
Generated
2026-07-20
AI Q&A
2026-07-19
EPSS Evaluated
N/A
NVD
CVE-2026-64145
EUVD
EUVD-2026-45830

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a memory leak in the wilc1000 WiFi driver. When the driver fails to acquire the bus during firmware download, it allocates a DMA buffer but does not free it properly due to an early return statement. This causes a memory leak.

Detection Guidance

This vulnerability is specific to the Linux kernel's wilc1000 WiFi driver and involves a DMA buffer leak during bus acquisition failure. Detection requires checking kernel logs for wilc1000-related errors or examining driver source code for the described issue. No direct commands exist to detect this specific flaw, but monitoring kernel logs for wilc1000 errors may indicate related issues.

Impact Analysis

This vulnerability could lead to memory exhaustion on systems using the wilc1000 WiFi driver. Over time, repeated failures to acquire the bus could deplete available memory, potentially causing system instability or crashes.

Compliance Impact

This vulnerability does not directly affect compliance with standards like GDPR or HIPAA as it is a local kernel memory leak in the wilc1000 WiFi driver. It does not involve data exposure or unauthorized access that would typically trigger compliance violations.

Mitigation Strategies

Apply the latest Linux kernel update that includes the fix for this vulnerability. If using a custom or older kernel, patch the wilc1000 driver to replace the early return with a goto fail statement in the firmware download function. Monitor kernel logs for wilc1000 errors as a potential indicator of exploitation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-64145. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart