CVE-2026-80948: wifi: iwlwifi: dvm: fix memory leak in iwl_op_mode_dvm_start()
In the Linux kernel, the following vulnerability has been resolved:
wifi: iwlwifi: dvm: fix memory leak in iwlopmodedvmstart()
In iwlopmodedvmstart(), jumping to outfreeeeprom currently bypasses the outfreeeepromblob label. Consequently, error paths triggered after successfully parsing the EEPROM free priv->nvmdata but leak priv->eepromblob.
Fix this memory leak by reordering the error handling labels so that outfreeeeprom falls through to outfreeeepromblob.
The bug was first flagged by an experimental analysis tool we are developing for kernel memory-management bugs while analyzing v6.13-rc1. The tool is still under development and is not yet publicly available. Manual inspection confirms that the bug is still present in v7.1-rc6.
An x8664 allyesconfig build showed no new warnings. As we do not have supported Intel DVM wireless hardware and firmware to test with, no runtime testing was able to be performed.
Affected Software
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems using the Linux iwlwifi DVM operation mode with supported Intel DVM wireless hardware and firmware may be exposed. The leak occurs on error paths after EEPROM parsing has succeeded.
What conditions are needed to trigger the memory leak?
An error must occur in iwl_op_mode_dvm_start() after the EEPROM has been successfully parsed. On that path, priv->nvm_data is freed while priv->eeprom_blob is not freed.
How long was the issue known to be present?
The issue was identified while analyzing Linux v6.13-rc1, and manual inspection confirmed it was still present in v7.1-rc6. The provided data does not include runtime validation on affected Intel DVM hardware and firmware.