CVE-2026-64179: Linux Kernel Memory Leak Vulnerability

CVE-2026-64179 Overview

CVE-2026-64179 is a memory leak vulnerability in the Linux kernel's Intel IOSM (iosm) WWAN modem driver. The flaw resides in the ipc_imem_init() function within the net/wwan/iosm subsystem. Memory allocated by ipc_protocol_init() is not released when subsequent initialization steps fail, causing kernel memory to leak on each failed device probe or reinitialization.

The upstream fix invokes the corresponding ipc_protocol_deinit() release routine on the error paths that follow the allocation. Repeated failures could gradually exhaust kernel memory on systems using Intel WWAN cellular modems.

Critical Impact
Repeated failed initializations of the iosm WWAN driver leak kernel memory in ipc_protocol_init(), degrading system stability over time on affected Linux hosts.

Affected Products

Linux kernel net/wwan/iosm driver (Intel IOSM cellular modem driver)
Multiple stable branches referenced by the kernel commits 583fd5a, 6f63a60, 8f764a7, ba6d864, c5d93b2, f1a4d57, and ffb6dbb
Linux distributions shipping unpatched kernels with the iosm driver enabled

Discovery Timeline

2026-07-19 - CVE-2026-64179 published to NVD
2026-07-19 - Last updated in NVD database

Technical Details for CVE-2026-64179

Vulnerability Analysis

The iosm driver initializes the Intel modem protocol layer during device bring-up. Inside ipc_imem_init(), the driver calls ipc_protocol_init(), which allocates internal protocol state and buffers.

After that allocation succeeds, ipc_imem_init() performs additional setup steps that can fail. On those failure branches, the function returns an error without freeing the memory previously allocated by ipc_protocol_init(). The corresponding cleanup routine ipc_protocol_deinit() is never invoked in the error path.

Each failed initialization attempt leaks a bounded amount of kernel heap memory. In environments where the WWAN device repeatedly fails to probe, is hot-plugged, or is bound and unbound through sysfs, the leak accumulates and reduces available kernel memory.

Root Cause

The root cause is missing error-path cleanup, a common resource management defect in kernel drivers. The initialization function did not unwind previously allocated resources before returning on later failures, violating the standard "goto err_..." cleanup pattern used elsewhere in the kernel.

Attack Vector

The issue is local and requires conditions that trigger initialization failures of the Intel WWAN modem. There is no evidence of remote exploitation, and no public proof-of-concept exists. The EPSS score is 0.161%, reflecting a low likelihood of exploitation. The primary risk is reliability and resource exhaustion, not privilege escalation or code execution.

The vulnerability manifests inside ipc_imem_init() when any post-ipc_protocol_init() step returns an error. See the kernel commits referenced below for the exact patched code paths.

Detection Methods for CVE-2026-64179

Indicators of Compromise

Growth in kernel slab memory attributable to iosm allocations visible in /proc/slabinfo or slabtop
Repeated iosm or wwan initialization failure messages in dmesg and journalctl -k
Gradual reduction in MemAvailable in /proc/meminfo on hosts with Intel WWAN hardware

Detection Strategies

Compare the running kernel version against the fixed commits (583fd5a, 6f63a60, 8f764a7, ba6d864, c5d93b2, f1a4d57, ffb6dbb) using uname -r and distribution changelogs
Monitor kernel logs for ipc_imem_init or ipc_protocol_init errors indicating repeated failed probes
Track long-term kernel memory usage on hosts with wwan interfaces to identify slow leaks

Monitoring Recommendations

Alert on sustained upward trends in kernel slab consumption on laptops and IoT gateways using Intel WWAN modems
Forward kernel logs to a centralized log platform and create rules for repeated iosm driver failures
Include kernel version inventory in vulnerability management scans to identify hosts missing the fix

How to Mitigate CVE-2026-64179

Immediate Actions Required

Update to a Linux kernel that includes the fix commits referenced in the Kernel Security Commit 583fd5a and companion patches
Apply vendor kernel updates from your Linux distribution as they become available
On systems without Intel WWAN hardware, unload or blacklist the iosm module to eliminate exposure

Patch Information

The fix adds a call to ipc_protocol_deinit() on the error paths of ipc_imem_init() so allocations from ipc_protocol_init() are released. The upstream patch is available in the kernel stable tree at Kernel Security Commit 6f63a6, with backports at 8f764a7, ba6d864, c5d93b2, f1a4d57, and ffb6dbb.

Workarounds

Blacklist the iosm module on systems that do not use Intel WWAN modems by adding blacklist iosm to /etc/modprobe.d/
Avoid repeatedly rebinding or hot-plugging the affected WWAN device on unpatched kernels
Reboot hosts that show sustained kernel memory growth attributable to the driver until patched kernels are deployed

bash

# Verify running kernel and iosm module state
uname -r
lsmod | grep iosm

# Temporarily unload the driver on hosts without Intel WWAN hardware
sudo modprobe -r iosm

# Persistently disable the module until a patched kernel is installed
echo 'blacklist iosm' | sudo tee /etc/modprobe.d/blacklist-iosm.conf