CVE-2026-63839: Linux Kernel Memory Leak Vulnerability

CVE-2026-63839 Overview

CVE-2026-63839 is a memory leak vulnerability in the Linux kernel's lenovo-wmi-helpers module within the platform/x86 subsystem. The flaw resides in the lwmi_dev_evaluate_int() helper function, which fails to free the output.pointer buffer when the retval parameter is NULL. The kernel developers resolved the issue by moving the ret_obj = output.pointer assignment outside the if (retval) block so the __free cleanup callback always releases the buffer. The fix introduces no functional change and is tracked in the upstream stable kernel tree.

Critical Impact
Repeated invocation of lwmi_dev_evaluate_int() with a NULL return value pointer causes kernel memory exhaustion on affected Lenovo hardware over time.

Affected Products

Linux kernel builds including the platform/x86: lenovo-wmi-helpers driver prior to the upstream fix
Lenovo systems relying on WMI helper interfaces exposed through the affected driver
Downstream distributions shipping the pre-patch stable kernel branches

Discovery Timeline

2026-07-19 - CVE CVE-2026-63839 published to NVD
2026-07-19 - Last updated in NVD database

Technical Details for CVE-2026-63839

Vulnerability Analysis

The defect is a kernel-mode memory leak [CWE-401] in the Lenovo WMI helper library. The lwmi_dev_evaluate_int() routine invokes ACPI evaluation and receives an acpi_buffer structure whose pointer field references a dynamically allocated union acpi_object. The original implementation only assigned this pointer to a variable protected by the __free cleanup attribute when the caller supplied a non-NULL retval argument.

When retval was NULL, the function returned without transferring ownership of output.pointer to the scope-bound cleanup handler. The allocation therefore persisted after the function exited, permanently consuming kernel heap memory. Each subsequent call with a NULL return pointer compounded the leak.

The issue was identified through static analysis by sashiko.dev. Because the leak occurs in a helper reachable from multiple driver code paths, sustained polling or event-driven callers can drive gradual memory pressure on affected Lenovo platforms.

Root Cause

The root cause is improper resource management around a conditional assignment. The ret_obj variable declared with the __free cleanup annotation only received ownership of output.pointer inside the if (retval) branch, leaving the allocation orphaned on the alternate path.

Attack Vector

The vulnerability is not remotely exploitable and requires code paths on Lenovo hardware that call lwmi_dev_evaluate_int() without requesting a return value. The practical consequence is resource exhaustion rather than code execution or privilege escalation. No public exploit is available and the flaw is not listed in the CISA Known Exploited Vulnerabilities catalog.

The vulnerability manifests entirely in the kernel resource-cleanup logic. Refer to the upstream commits for the exact code change.

Detection Methods for CVE-2026-63839

Indicators of Compromise

Progressive growth of kernel slab allocations attributable to ACPI object buffers on Lenovo hardware
Repeated invocations of lwmi_dev_evaluate_int() observed via ftrace or kprobes correlating with rising Slab values in /proc/meminfo
kmemleak reports referencing allocations originating from ACPI evaluation paths in the lenovo-wmi-helpers module

Detection Strategies

Enable CONFIG_DEBUG_KMEMLEAK on test kernels and audit reports for leaks tied to acpi_evaluate_object callers within the Lenovo WMI helpers
Monitor kernel version strings across the fleet to identify hosts running builds that predate the upstream commits 0c3887a134f1 and 40a984dd0602
Track long-running Lenovo endpoints for unexplained kernel memory growth using node-level telemetry

Monitoring Recommendations

Baseline Slab and SReclaimable counters from /proc/meminfo and alert on sustained upward trends without workload justification
Collect dmesg output for ACPI evaluation warnings or kmemleak notifications and forward to centralized log storage
Include kernel package versions in configuration management inventories to confirm patch adoption

How to Mitigate CVE-2026-63839

Immediate Actions Required

Apply the upstream stable kernel updates containing commits 0c3887a134f1 and 40a984dd0602 referenced in the Kernel Git Commit Update and the companion Kernel Git Commit Update
Rebuild or update distribution kernels that include the lenovo-wmi-helpers driver and reboot affected Lenovo hosts
Verify patch level using uname -r and vendor package metadata after rollout

Patch Information

The fix moves the ret_obj = output.pointer assignment out of the if (retval) block so the __free cleanup callback consistently releases the ACPI buffer. The change is functionally equivalent for callers that supply a non-NULL retval and eliminates the leak for the NULL case. Both stable branch commits are available in the upstream kernel Git repository.

Workarounds

Unload the lenovo-wmi-helpers module and any dependent drivers on systems where the affected functionality is not required
Restart affected Lenovo hosts on a scheduled cadence until the patched kernel can be deployed to reclaim leaked memory
Restrict administrative tooling that repeatedly triggers Lenovo WMI evaluations while patch deployment is pending

bash

# Verify running kernel version and remove the module if unused
uname -r
lsmod | grep lenovo_wmi
sudo modprobe -r lenovo_wmi_helpers