CVE-2026-64145 Overview
CVE-2026-64145 is a memory leak vulnerability in the Linux kernel's wilc1000 WiFi driver. The flaw resides in the wilc_wlan_firmware_download() function, which allocates a DMA buffer via kmalloc() at function entry. All later error paths correctly route cleanup through the fail: label, but the early failure path following the first acquire_bus() call uses a bare return ret; statement. This bypasses the cleanup code and leaks the DMA buffer whenever bus acquisition fails. The issue was found using a custom Coccinelle semantic patch that hunts for kmalloc'd locals leaked on early-return error paths in driver firmware-download code.
Critical Impact
Repeated bus acquire failures during firmware download can exhaust kernel memory over time, leading to resource starvation on systems using WILC1000 WiFi hardware.
Affected Products
- Linux kernel builds including the wilc1000 wireless driver
- Embedded and IoT platforms using Microchip WILC1000 SDIO/SPI WiFi modules
- Distributions shipping the affected drivers/net/wireless/microchip/wilc1000 code prior to the fix commits
Discovery Timeline
- 2026-07-19 - CVE-2026-64145 published to NVD
- 2026-07-19 - Last updated in NVD database
Technical Details for CVE-2026-64145
Vulnerability Analysis
The vulnerability is a kernel memory leak [CWE-401] in the WILC1000 wireless driver firmware download routine. When wilc_wlan_firmware_download() begins execution, it allocates a DMA-capable buffer with kmalloc() to stage firmware image chunks for transfer to the device. The function is structured around a common cleanup pattern using a fail: label at the bottom, which frees the buffer via kfree(dma_buffer) before returning.
Most error paths correctly use goto fail to reach this cleanup. The exception is the error path immediately after the first acquire_bus() call. That path uses a bare return ret; statement, exiting the function without releasing the allocated buffer. Every failed bus acquisition during firmware download therefore leaks the buffer.
The EPSS score for this issue is 0.166%, reflecting a low likelihood of remote exploitation. Impact is limited to kernel memory exhaustion rather than code execution or privilege escalation.
Root Cause
The root cause is an inconsistent error-handling pattern. The function mixes goto fail cleanup with a bare return statement, breaking the invariant that every exit path must release the DMA buffer allocated at function entry.
Attack Vector
An attacker cannot directly trigger this leak remotely. Triggering requires conditions that cause acquire_bus() to fail during firmware download, such as SDIO or SPI bus errors, hardware faults, or driver reload cycles. Systems that repeatedly reinitialize the WILC1000 device under fault conditions accumulate leaked kernel memory, eventually degrading system stability.
The fix replaces the early return ret; with goto fail, routing the failure path through the existing cleanup code. See the upstream commits 32d7584441b9, 95c82d498d74, and dd7b6a867193 for the resolved code.
Detection Methods for CVE-2026-64145
Indicators of Compromise
- Progressive decline in available kernel memory (MemAvailable in /proc/meminfo) on systems using WILC1000 hardware
- Repeated acquire_bus failure messages in kernel logs from the wilc1000 driver
- kmalloc slab growth without corresponding frees observed in /proc/slabinfo on affected hosts
Detection Strategies
- Audit installed Linux kernel versions against the fix commits listed in the upstream references to identify unpatched systems
- Monitor dmesg output for wilc1000 firmware download errors correlated with SDIO or SPI bus faults
- Use kmemleak on debug kernels to identify leaked allocations originating from wilc_wlan_firmware_download
Monitoring Recommendations
- Track kernel slab memory trends on IoT and embedded fleets using WILC1000 modules
- Alert on repeated WiFi driver reload events, which can amplify the leak
- Correlate WiFi hardware fault telemetry with host memory pressure metrics
How to Mitigate CVE-2026-64145
Immediate Actions Required
- Apply the upstream stable kernel patches referenced by commits 32d7584441b9, 95c82d498d74, and dd7b6a867193
- Update to a distribution kernel that incorporates the fix for the wilc1000 DMA buffer leak
- Inventory embedded and IoT assets using WILC1000 hardware to prioritize patch deployment
Patch Information
The fix replaces the bare return ret; in the early failure path with goto fail, ensuring the existing kfree(dma_buffer) cleanup runs on all error returns from wilc_wlan_firmware_download(). Patches are available through the upstream Linux stable tree in the three referenced commits.
Workarounds
- Reduce the frequency of WILC1000 driver reloads and firmware reinitializations on unpatched hosts
- Schedule periodic reboots for long-running embedded devices where patching is not immediately feasible
- Disable or unload the wilc1000 module on systems that do not require the wireless interface
# Verify kernel version and check for the fix
uname -r
# Inspect wilc1000 driver messages for bus acquire failures
dmesg | grep -i wilc
# Unload the module on unpatched systems if WiFi is unused
sudo modprobe -r wilc1000
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
