CVE-2026-68410: Linux Kernel Libertas WiFi Memory Leak

CVE-2026-68410 Overview

CVE-2026-68410 is a memory leak vulnerability in the Linux kernel's libertas wireless driver. The flaw resides in the helper_firmware_cb() function within the USB firmware-download path. After a successful asynchronous firmware load, the driver fails to release the single-stage firmware image buffer, causing kernel memory to leak on each invocation. The issue was identified through experimental static analysis of Linux kernel v6.13-rc1 and confirmed present in the current wireless tree by manual inspection. The fix calls release_firmware() immediately after lbs_fw_loaded() returns.

Critical Impact
Repeated firmware-download operations on affected libertas USB Wi-Fi adapters can exhaust kernel memory over time, degrading system stability on long-running hosts.

Affected Products

Linux kernel wireless subsystem — libertas driver (USB firmware-download path)
Linux kernel versions prior to the fixes referenced in stable commits 63c2391d, 644640cd, 6cda91bb, d497b756, and eaeb1d74
Systems using Marvell Libertas 8388 USB Wi-Fi adapters

Discovery Timeline

2026-08-10 - CVE-2026-68410 published to NVD
2026-08-10 - Last updated in NVD database

Technical Details for CVE-2026-68410

Vulnerability Analysis

The vulnerability is a kernel memory leak in the libertas Wi-Fi driver, which supports Marvell 8388 USB devices. During device initialization, the driver requests a helper firmware image asynchronously through the kernel firmware loader. The completion callback helper_firmware_cb() receives a pointer to the loaded firmware buffer and forwards it to lbs_fw_loaded() for device programming.

After lbs_fw_loaded() returns on the success path, the callback exits without invoking release_firmware() on the single-stage firmware image. The buffer remains allocated in kernel memory with no remaining reference for later cleanup. Every successful firmware-load cycle leaks the entire firmware image. Repeated USB reconnects, driver reloads, or suspend/resume cycles compound the leak.

The patch adds a release_firmware() call immediately after lbs_fw_loaded() returns, ensuring the firmware buffer reference count is properly decremented and the memory reclaimed.

Root Cause

The root cause is a missing resource-release call on the success path of an asynchronous firmware-load callback. The libertas driver treats the helper firmware as consumed after lbs_fw_loaded() but never releases the reference held by the firmware subsystem, leaving the kernel-allocated buffer unreachable.

Attack Vector

This is a local reliability defect rather than a remotely exploitable flaw. Triggering the leak requires physical presence or local privileged action to bind a libertas USB Wi-Fi adapter or reload the driver. No user-controlled input reaches the affected code path from the network. Impact is limited to kernel memory pressure and long-term denial of service on systems that repeatedly cycle the firmware load.

See the upstream fix at Linux Kernel Commit 63c2391d for the exact source change.

Detection Methods for CVE-2026-68410

Indicators of Compromise

Steadily increasing Slab and SUnreclaim values in /proc/meminfo on hosts using libertas USB Wi-Fi adapters.
Growth in kernel kmalloc allocations correlated with repeated libertas driver bind, unbind, or firmware reload events.
dmesg entries showing repeated libertas firmware-load success messages without corresponding memory reclamation.

Detection Strategies

Run kmemleak on kernel builds compiled with CONFIG_DEBUG_KMEMLEAK=y and inspect /sys/kernel/debug/kmemleak for unreferenced allocations attributed to the firmware loader.
Track kernel version and installed patch level against the fixed commits listed in the vendor advisory references.
Correlate USB device attach events for Marvell Libertas 8388 adapters with slab allocator growth over time.

Monitoring Recommendations

Alert on sustained kernel slab growth exceeding baseline on Linux endpoints that load the libertas module.
Monitor modprobe and udev events for repeated loads of the libertas and libertas_usb modules.
Include kernel version telemetry in asset inventories to identify hosts running pre-patch builds.

How to Mitigate CVE-2026-68410

Immediate Actions Required

Apply the upstream kernel patch or update to a stable kernel release containing commits 63c2391d, 644640cd, 6cda91bb, d497b756, or eaeb1d74.
Inventory Linux hosts using Marvell Libertas 8388 USB Wi-Fi adapters and prioritize them for kernel updates.
If patching is deferred, avoid repeated driver reloads or firmware download cycles on affected systems.

Patch Information

The fix is available in the mainline and stable Linux kernel trees. Refer to Linux Kernel Commit 63c2391d, Linux Kernel Commit 644640cd, Linux Kernel Commit 6cda91bb, Linux Kernel Commit d497b756, and Linux Kernel Commit eaeb1d74. The patch adds a release_firmware() call immediately after lbs_fw_loaded() in helper_firmware_cb().

Workarounds

Blacklist the libertas and libertas_usb kernel modules on systems that do not require Marvell 8388 Wi-Fi support.
Unbind affected USB devices and disable automatic firmware reloading until the patched kernel is deployed.
Schedule periodic reboots on long-running hosts to reclaim leaked kernel memory as an interim measure.

bash

# Blacklist the vulnerable driver until patching is possible
echo "blacklist libertas" | sudo tee /etc/modprobe.d/blacklist-libertas.conf
echo "blacklist libertas_usb" | sudo tee -a /etc/modprobe.d/blacklist-libertas.conf
sudo update-initramfs -u