CVE-2026-68410: wifi: libertas: fix memory leak in helper_firmware_cb()
In the Linux kernel, the following vulnerability has been resolved:
wifi: libertas: fix memory leak in helperfirmwarecb()
helperfirmwarecb() neglects to free the single-stage firmware image after a successful async load, leading to a memory leak in the USB firmware-download path.
Fix this memory leak by calling releasefirmware() immediately after lbsfwloaded() returns.
The bug was first flagged by an experimental analysis tool we are developing for kernel memory-management bugs while analyzing v6.13-rc1. The tool is still under development and is not yet publicly available. Manual inspection confirms that the bug is still present in the current wireless tree.
An x8664 allyesconfig build showed no new warnings. As we do not have compatible Libertas USB hardware for exercising this firmware-download path, no runtime testing was able to be performed.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Linux kernel (wifi: libertas)to a version that resolves this vulnerability.Fixed in v6.13-rc1 - Configuration
In helper_firmware_cb(), call release_firmware() immediately after a successful async load to free the single-stage firmware image and prevent a memory leak in the USB firmware-download path (lbs_fw_loaded() should be returning after the firmware image is freed).
Linux kernel module: libertas helper_firmware_cb() firmware image release = release_firmware() immediately after successful async load
Event History
Frequently Asked Questions
What is the severity of CVE-2026-68410?
CVE-2026-68410 has a risk severity rating of 10, indicating a critical issue.
How do I fix CVE-2026-68410?
To fix CVE-2026-68410, you should update your Linux kernel to the latest version where this vulnerability has been patched.
What type of vulnerability is CVE-2026-68410?
CVE-2026-68410 is a memory leak vulnerability in the Linux kernel's wifi libertas driver.
What are the potential impacts of CVE-2026-68410?
CVE-2026-68410 can lead to system instability and resource exhaustion due to uncontrolled memory leakage.
Which component of the Linux kernel is affected by CVE-2026-68410?
CVE-2026-68410 affects the helper_firmware_cb() function in the wifi libertas driver.