CVE-2026-80948

Received Received - Intake

Memory Leak in Linux Kernel iwlwifi DVM Mode

Publication date: 2026-09-11

Last updated on: 2026-09-11

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: dvm: fix memory leak in iwl_op_mode_dvm_start() In iwl_op_mode_dvm_start(), jumping to out_free_eeprom currently bypasses the out_free_eeprom_blob label. Consequently, error paths triggered after successfully parsing the EEPROM free priv->nvm_data but leak priv->eeprom_blob. Fix this memory leak by reordering the error handling labels so that out_free_eeprom falls through to out_free_eeprom_blob. The bug was first flagged by an experimental analysis tool we are developing for kernel memory-management bugs while analyzing v6.13-rc1. The tool is still under development and is not yet publicly available. Manual inspection confirms that the bug is still present in v7.1-rc6. An x86_64 allyesconfig build showed no new warnings. As we do not have supported Intel DVM wireless hardware and firmware to test with, no runtime testing was able to be performed.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-11

Last Modified

2026-09-11

Generated

2026-09-12

AI Q&A

2026-09-12

EPSS Evaluated

N/A

NVD

CVE-2026-80948

EUVD

EUVD-2026-76271

Affected Vendors & Products

Vendor	Product	Version / Range
intel	iwlwifi	From 6.13-rc1 (inc) to 7.1-rc6 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a memory leak vulnerability in the Linux kernel's iwlwifi driver for Intel wireless devices. When the iwl_op_mode_dvm_start() function encounters an error after parsing the EEPROM, it fails to properly free priv->eeprom_blob, causing memory to be leaked. The fix involves reordering error handling labels to ensure proper cleanup.

Detection Guidance

This vulnerability is a Linux kernel memory leak in the iwlwifi driver. Detection requires checking for memory leaks in the iwlwifi module. Use commands like 'dmesg | grep iwlwifi' to check for driver errors or 'cat /proc/meminfo' to monitor memory usage for unusual patterns. Kernel logs may show related errors.

Impact Analysis

This vulnerability could lead to gradual memory exhaustion on systems using affected Intel wireless hardware. Over time, this may cause system performance degradation, instability, or crashes due to running out of available memory.

Mitigation Strategies

Apply the latest Linux kernel update that includes the fix for CVE-2026-80948. If immediate patching is not possible, consider disabling the affected iwlwifi driver module if not required. Monitor system memory usage for leaks.

Hi! I’m here to help you understand CVE-2026-80948. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70