CVE-2026-64155: Linux Kernel Information Disclosure Flaw

CVE-2026-64155 Overview

CVE-2026-64155 is a memory leak vulnerability in the Linux kernel ath11k wireless driver. The flaw exists in the Wireless Miscellaneous Interface (WMI) Wake-on-Wireless (WOW) call handling logic. Two code paths directly return the result of ath11k_wmi_cmd_send(...) without checking the return value. When the command fails, the associated socket buffer (skb) is not freed, causing kernel memory to leak on each error occurrence.

The vulnerability affects systems using Qualcomm ath11k Wi-Fi chipsets with Wake-on-Wireless-LAN functionality. Repeated triggering of the error path can exhaust kernel memory over time.

Critical Impact
Repeated failures in WMI WOW command paths cause kernel skb memory leaks that can degrade system stability and consume kernel memory resources.

Affected Products

Linux kernel versions containing the vulnerable ath11k WMI WOW call implementations
Systems with Qualcomm ath11k Wi-Fi chipset drivers enabled
Distributions shipping affected upstream kernel versions prior to the referenced stable commits

Discovery Timeline

2026-07-19 - CVE-2026-64155 published to NVD
2026-07-19 - Last updated in NVD database

Technical Details for CVE-2026-64155

Vulnerability Analysis

The vulnerability resides in the ath11k driver, which supports Qualcomm 802.11ax Wi-Fi 6 devices. Two functions handling Wake-on-Wireless (WOW) WMI commands directly returned the result of ath11k_wmi_cmd_send() without evaluating success or failure.

The ath11k_wmi_cmd_send() function transmits a WMI command using a socket buffer (skb). On success, the driver framework consumes the buffer. On failure, the caller retains ownership and must release the skb via dev_kfree_skb(). The affected code paths omitted this cleanup step.

Each failed WMI WOW command therefore leaves an orphaned skb in kernel memory. Repeated failures accumulate leaked buffers, consuming non-swappable kernel memory over time [CWE-401].

Root Cause

The root cause is missing error path handling in two ath11k WMI WOW helper functions. Instead of storing the return value from ath11k_wmi_cmd_send(), checking it, and freeing the skb on error, the code returned the value directly. This pattern violates the driver's memory ownership contract for WMI command buffers.

Attack Vector

Exploitation requires conditions that force the WMI WOW command path to fail. This typically involves firmware errors, hardware state issues, or command queue exhaustion. A local attacker with the ability to trigger WOW configuration operations could repeatedly force failures to induce kernel memory pressure. The vulnerability primarily represents a stability and resource exhaustion concern rather than a direct code execution vector.

The vulnerability is described in prose because no verified exploit code is available. Refer to the Linux Kernel Commit 008955b and Linux Kernel Commit d6c7b8 for the upstream fixes.

Detection Methods for CVE-2026-64155

Indicators of Compromise

Progressive increase in kernel slab memory attributed to skbuff_head_cache without corresponding network activity
Repeated ath11k WMI command failure messages in dmesg or journalctl -k output
Growing SReclaimable and SUnreclaim values in /proc/meminfo on systems using ath11k Wi-Fi

Detection Strategies

Monitor kernel logs for ath11k WMI error messages, particularly around WOW configuration transitions such as suspend and resume cycles
Track kernel memory consumption trends using slabtop and /proc/slabinfo for skbuff object accumulation
Correlate Wi-Fi driver events with kernel memory growth patterns using EPSS score 0.173% as a baseline low-exploitation-probability signal

Monitoring Recommendations

Enable kernel memory leak detection via CONFIG_DEBUG_KMEMLEAK on test systems running affected kernels
Alert on unexpected kernel memory growth exceeding baseline on endpoints with ath11k hardware
Audit suspend and resume cycles on laptops with Qualcomm Wi-Fi 6 chipsets for repeated WMI failures

How to Mitigate CVE-2026-64155

Immediate Actions Required

Update the Linux kernel to a version containing the upstream fix commits referenced by kernel.org
Identify affected endpoints by checking for ath11k module load with lsmod | grep ath11k
Prioritize patching mobile and laptop fleets using Qualcomm Wi-Fi 6 chipsets where suspend and resume cycles are frequent

Patch Information

The fix stores the return value of ath11k_wmi_cmd_send(), checks for failure, and frees the skb via dev_kfree_skb() when an error occurs. The correction is available across multiple stable branches via the following commits: 008955b, 3d67589, 55dda53, acde469, cd43d58, d618d32, and d6c7b8d.

Workarounds

Disable Wake-on-Wireless-LAN functionality on affected systems using iw phy phy0 wowlan disable where operationally acceptable
Unload the ath11k module if Wi-Fi functionality is not required on affected servers
Reboot systems periodically to reclaim leaked kernel memory until the patch is applied

bash

# Configuration example: verify kernel version and disable WoWLAN as a temporary workaround
uname -r
iw phy phy0 wowlan disable
dmesg | grep -i ath11k