CVE-2026-80948: Linux Kernel iwlwifi Use-After-Free Vulnerability

CVE-2026-80948 Overview

CVE-2026-80948 is a memory leak vulnerability in the Linux kernel's Intel wireless (iwlwifi) DVM driver. The flaw resides in the iwl_op_mode_dvm_start() function within the wireless subsystem. Error paths triggered after successful EEPROM parsing free priv->nvm_data but fail to release priv->eeprom_blob because the out_free_eeprom label bypasses out_free_eeprom_blob.

The issue was identified through an experimental kernel memory-management analysis tool during review of Linux v6.13-rc1, and manual inspection confirmed the bug remained in v7.1-rc6. The fix reorders the error handling labels so out_free_eeprom falls through to out_free_eeprom_blob.

Critical Impact
Repeated failure paths during Intel DVM wireless driver initialization can leak kernel memory allocated for the EEPROM blob, gradually exhausting kernel resources on affected systems.

Affected Products

Linux kernel versions containing the iwlwifi DVM driver, confirmed present in v6.13-rc1 through v7.1-rc6
Systems using legacy Intel wireless hardware supported by the DVM (Divided Multi-mode) driver
Linux distributions shipping unpatched upstream kernels with the affected code path

Discovery Timeline

2026-09-11 - CVE-2026-80948 published to NVD
2026-09-13 - Last updated in NVD database

Technical Details for CVE-2026-80948

Vulnerability Analysis

The vulnerability is a memory leak [CWE-401] in the initialization routine iwl_op_mode_dvm_start() of the Intel wireless DVM driver (drivers/net/wireless/intel/iwlwifi/dvm/). The function allocates several resources during device bring-up, including the parsed non-volatile memory data (priv->nvm_data) and the EEPROM blob (priv->eeprom_blob).

When an error occurs after successful EEPROM parsing, control transfers to the out_free_eeprom label. This label releases priv->nvm_data and then returns without falling through to out_free_eeprom_blob, so the memory backing priv->eeprom_blob is never freed.

Each failed initialization attempt leaks the EEPROM blob allocation. On systems that repeatedly reload the driver or where initialization fails intermittently, kernel memory pressure increases over time.

Root Cause

The root cause is incorrect ordering of goto labels in an error-handling ladder. Kernel drivers commonly implement cleanup using cascading goto labels that fall through to release resources allocated earlier in the initialization sequence. In iwl_op_mode_dvm_start(), the out_free_eeprom label was placed such that it returns before reaching out_free_eeprom_blob, breaking the expected cleanup chain.

The fix reorders the labels so out_free_eeprom naturally falls through to out_free_eeprom_blob, restoring the standard kernel unwinding pattern.

Attack Vector

The vulnerability is not remotely exploitable and does not grant code execution or privilege escalation. Triggering the leak requires the DVM driver to reach the specific error paths after EEPROM parsing succeeds. This is typically caused by firmware load failures, hardware faults, or repeated driver load/unload cycles.

An attacker with local access to a system with affected Intel DVM wireless hardware could potentially induce repeated initialization failures to exhaust kernel memory, but no runtime exploitation has been demonstrated. The reporting author noted no supported hardware was available for runtime testing.

The vulnerability is described in prose here because the upstream commit is the authoritative technical reference. See the Kernel Git Commit - 84ba017 for the exact diff.

Detection Methods for CVE-2026-80948

Indicators of Compromise

Growth in kernel slab allocations attributable to iwlwifi on systems with Intel DVM wireless hardware
Repeated iwl_op_mode_dvm_start() failure messages in dmesg or journalctl -k output
Progressive reduction in available kernel memory (MemAvailable in /proc/meminfo) on long-running hosts with the affected driver

Detection Strategies

Audit installed kernel versions against the fixed commits referenced in the upstream stable tree to identify hosts still running vulnerable code
Monitor kmemleak reports on development or staging kernels built with CONFIG_DEBUG_KMEMLEAK=y for allocations tied to iwlwifi DVM initialization
Correlate wireless driver initialization failures with subsequent kernel memory pressure events in host telemetry

Monitoring Recommendations

Ingest kernel logs into a centralized logging or SIEM platform and alert on recurring iwlwifi initialization errors
Track long-term trends in /proc/slabinfo for anomalous growth on endpoints using Intel DVM wireless adapters
Include kernel version and patch-level inventory in endpoint asset management to prioritize remediation

How to Mitigate CVE-2026-80948

Immediate Actions Required

Identify Linux hosts running kernels between v6.13-rc1 and v7.1-rc6 that use the iwlwifi DVM driver
Apply the upstream stable kernel updates that include the label reordering fix
Reboot affected systems after installing the patched kernel to load the corrected driver

Patch Information

The fix has been merged upstream and backported to stable trees. See the following commits for the applied changes: Kernel Git Commit - 67105ab, Kernel Git Commit - 84ba017, and Kernel Git Commit - ad2a9fd. Consume the kernel packages provided by your Linux distribution once these commits are included in a stable release.

Workarounds

Unload the iwldvm module on systems that do not require Intel DVM wireless functionality using modprobe -r iwldvm
Blacklist the module in /etc/modprobe.d/ to prevent loading on hosts where the wireless adapter is unused
Reboot systems periodically to reset kernel memory state where patching is not immediately feasible

bash

# Prevent the affected driver from loading where wireless is not needed
echo "blacklist iwldvm" | sudo tee /etc/modprobe.d/blacklist-iwldvm.conf
sudo update-initramfs -u