CVE-2026-98710 in Linux
Summary
by MITRE • 10/18/2026
In the Linux kernel, the following vulnerability has been resolved:
wifi: iwlegacy: 3945: free EEPROM data on remove
il3945_pci_probe() calls il_eeprom_init(), which allocates memory for the EEPROM data. The probe failure paths release this allocation with il_eeprom_free(), but the remove path does not free it after a successful probe.
As a result, the EEPROM data is leaked when the PCI device is removed.
Free the EEPROM data in il3945_pci_remove() before releasing the mac80211 hardware structure.
This issue was found by manual code inspection.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/18/2026
The Linux kernel driver for Intel Wireless WiFi Link 3945ABG, specifically within the iwlegacy subsystem, contains a resource management flaw in its PCI device lifecycle handling. The vulnerability manifests as a memory leak that occurs during the removal phase of the device's operational life cycle. When the il3945_pci_probe function is invoked to initialize the hardware, it calls il_eeprom_init to allocate and populate data structures containing EEPROM information essential for device operation. While the code correctly implements error handling paths that release this allocated memory via il_eeprom_free in the event of a probe failure, it fails to perform an equivalent cleanup action when the PCI device is successfully removed from the system. This asymmetry between initialization success and removal procedures results in persistent allocation of kernel heap memory that is never returned to the system pool.
From a technical perspective, this defect represents a classic resource leak vulnerability where dynamic memory allocated during driver attachment is not freed upon detachment. In the context of Linux kernel development, such leaks are particularly concerning because they occur within the privileged kernel space rather than user-space applications. Each time the device is removed and potentially re-added to the system bus, or if multiple instances exist in a multi-device environment, additional memory blocks remain allocated but inaccessible. Over time, repeated occurrences of this event can lead to gradual depletion of available kernel memory resources. This degradation of resource availability can eventually impact system stability by increasing pressure on the memory allocator, potentially leading to allocation failures for other critical subsystems or triggering out-of-memory conditions that may force a system reboot or cause service disruptions for network-dependent applications relying on stable hardware access.
The operational impact of this vulnerability is primarily related to long-term system reliability and resource exhaustion rather than immediate security exploitation such as privilege escalation or remote code execution. However, in scenarios involving automated device management systems where devices are frequently hot-plugged and removed, the cumulative effect of these leaks could accelerate memory fragmentation and consumption. This aligns with CWE-401, which describes a missing release of memory after effective usage, highlighting the failure to properly manage dynamically allocated resources. The lack of proper cleanup in the remove path indicates an oversight in adhering to robust driver development practices that mandate symmetric allocation and deallocation logic for all device lifecycle states.
Mitigation strategies involve applying the upstream kernel patch that introduces a call to il_eeprom_free within the il3945_pci_remove function, ensuring that EEPROM data is released before the mac80211 hardware structure is dismantled. System administrators should ensure their Linux kernels are updated to versions containing this fix. For environments where immediate patching is not feasible, monitoring kernel memory usage and reviewing dmesg logs for allocation warnings can help detect abnormal growth patterns associated with such leaks. Adherence to static analysis tools during driver development phases would also prevent similar issues by enforcing checks that verify all allocated resources are accounted for in every exit path of the device lifecycle functions. This incident underscores the importance of rigorous code inspection and adherence to established coding standards like those outlined in CWE-401 to maintain kernel integrity and stability.