CVE-2026-64145

High

Description

In the Linux kernel, the following vulnerability has been resolved: wifi: wilc1000: fix dma_buffer leak on bus acquire failure wilc_wlan_firmware_download() allocates dma_buffer with kmalloc() at the top of the function and uses a 'fail:' label to free it via kfree(dma_buffer) on error. All later error paths correctly use 'goto fail' to route through this cleanup. However, the early failure path after the first acquire_bus() call uses a bare 'return ret;', which leaks dma_buffer whenever the bus acquire fails. Replace the early return with goto fail so the existing cleanup path runs. Found via a custom Coccinelle semantic patch hunting for kmalloc'd locals leaked on early-return error paths in driver firmware-download code.

SeverityHigh
CVSS7.8
Exploit probability—
ProductLinux Kernel
PublishedJul 19, 2026
First seenJul 19, 2026

How to fix

Update
  • linux linux_kernel6.18.34, 7.0.11 or later

Affected products

ProductAffected versionsFixed in
linux linux_kernel6.13 ≤ v < 6.18.34, 6.19 ≤ v < 7.0.11, 7.16.18.34, 7.0.11

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.