CVE-2026-64179 in Linux
Summary
by MITRE • 07/19/2026
In the Linux kernel, the following vulnerability has been resolved:
net: wwan: iosm: fix potential memory leaks in ipc_imem_init()
The memory allocated in ipc_protocol_init() is not freed on the error paths that follow in ipc_imem_init(). Fix that by calling the corresponding release function ipc_protocol_deinit() in the error path.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 07/19/2026
This vulnerability resides within the Linux kernel's wireless wide area network subsystem, specifically affecting the iosm driver implementation that manages communication with cellular modems. The issue manifests as a memory leak condition occurring during the initialization sequence of the IPC (Inter-Processor Communication) memory management component. When the ipc_protocol_init() function successfully allocates memory resources, subsequent error conditions in the ipc_imem_init() function fail to properly release these allocated resources through the appropriate cleanup mechanism.
The technical flaw represents a classic resource management issue where proper error path handling is absent from the memory allocation workflow. During normal operation, ipc_protocol_init() allocates memory structures necessary for inter-processor communication within the modem subsystem, but when errors occur during the subsequent ipc_imem_init() processing, the corresponding ipc_protocol_deinit() function is never invoked to release the previously allocated memory. This results in memory leaks that accumulate over time and can potentially lead to system instability or resource exhaustion scenarios.
The operational impact of this vulnerability extends beyond simple memory consumption issues as it affects the overall reliability and performance of systems utilizing the iosm WWAN driver. Systems running embedded cellular modems, such as those found in IoT devices, automotive applications, or mobile routers, may experience progressive memory degradation that could eventually cause system crashes or require forced reboots to recover allocated resources. The vulnerability is particularly concerning in environments where these devices operate continuously without manual intervention, as the memory leaks compound over extended periods of operation.
Mitigation strategies should focus on implementing proper error path handling within the driver code to ensure all allocated resources are released regardless of execution flow. The fix involves adding explicit calls to ipc_protocol_deinit() within the error handling branches of ipc_imem_init() function to mirror the resource allocation pattern established by ipc_protocol_init(). This approach aligns with security best practices outlined in common weakness enumeration cwe-401, which addresses improper release of memory and other resources. Additionally, this vulnerability may be relevant to attack vectors described in the attack technique t1059 related to system compromise through resource exhaustion or memory corruption exploits. Organizations should prioritize applying kernel updates containing this fix and consider implementing monitoring solutions to detect memory leak patterns that could indicate similar issues in other driver components.