CVE-2026-64145 in Linux
Summary
by MITRE • 07/19/2026
In the Linux kernel, the following vulnerability has been resolved:
wifi: wilc1000: fix dma_buffer leak on bus acquire failure
wilc_wlan_firmware_download() allocates dma_buffer with kmalloc() at the top of the function and uses a 'fail:' label to free it via kfree(dma_buffer) on error.
All later error paths correctly use 'goto fail' to route through this cleanup. However, the early failure path after the first acquire_bus() call uses a bare 'return ret;', which leaks dma_buffer whenever the bus acquire fails.
Replace the early return with goto fail so the existing cleanup path runs.
Found via a custom Coccinelle semantic patch hunting for kmalloc'd locals leaked on early-return error paths in driver firmware-download code.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 07/19/2026
The vulnerability in question affects the wilc1000 wireless driver within the Linux kernel, specifically addressing a memory management issue that occurs during firmware download operations. This flaw represents a classic memory leak scenario where dynamically allocated kernel memory is not properly released when error conditions are encountered early in the execution flow. The vulnerability manifests in the wilc_wlan_firmware_download() function which manages the process of downloading firmware to the wilc1000 wireless chip, making it particularly concerning for wireless network operations and device stability.
The technical implementation flaw stems from inconsistent error handling patterns within the driver's firmware download routine. The function correctly allocates a dma_buffer using kmalloc() at the beginning and establishes a dedicated cleanup label named 'fail:' that properly releases this memory via kfree(dma_buffer). Subsequent error paths throughout the function correctly utilize goto fail statements to ensure proper resource deallocation. However, an early exit path following the first acquire_bus() call employs a direct return ret; statement instead of the established cleanup mechanism, creating a scenario where the allocated dma_buffer remains unreleased when bus acquisition fails.
This memory leak vulnerability directly impacts system stability and resource utilization, particularly in embedded systems or devices with constrained memory resources. When the bus acquisition fails, the kernel allocates memory for the dma_buffer but cannot subsequently free it due to the early return statement bypassing the normal cleanup path. Over time, repeated firmware download attempts that fail during bus acquisition would progressively consume system memory without proper release, potentially leading to system instability, performance degradation, or even system crashes in severe cases. The vulnerability aligns with CWE-401, which specifically addresses improper deallocation of memory, and demonstrates poor adherence to defensive programming practices in kernel space code.
The operational impact extends beyond simple memory consumption issues, as this flaw could affect wireless connectivity reliability and device power management. In practical deployment scenarios, particularly in IoT devices or embedded systems running Linux kernels with the affected driver, repeated firmware download failures would compound the memory leak, potentially causing system resource exhaustion. The issue was identified through automated semantic analysis using Coccinelle tooling, which specifically targets kmalloc'd local variables that are leaked on early return error paths within driver firmware download code sections, demonstrating how modern static analysis techniques can uncover subtle but critical kernel vulnerabilities.
Mitigation strategies should focus on implementing consistent error handling patterns throughout the driver codebase, ensuring all exit paths from functions properly clean up allocated resources. The fix requires replacing the bare return ret; statement with goto fail to maintain uniform resource management practices. Additionally, comprehensive code review processes should be implemented to identify and prevent similar patterns in other kernel drivers, particularly those handling hardware resource acquisition and firmware operations. Security teams should also consider implementing automated static analysis checks as part of their kernel development pipeline to catch such memory leak vulnerabilities before they reach production environments, following ATT&CK technique T1486 for credential dumping and system resource hijacking that could result from such memory management failures.
The vulnerability underscores the critical importance of consistent resource management in kernel space programming and demonstrates how seemingly minor coding inconsistencies can lead to significant operational impacts. Proper error handling implementation becomes essential when dealing with hardware resource management, particularly in wireless driver contexts where firmware download operations are frequent and system stability is paramount for continuous network connectivity.