CVE-2026-64145 wifi: wilc1000: fix dma_buffer leak on bus acquire failure
A memory leak in the wilc1000 WiFi driver allows attackers to cause denial of service by triggering bus acquire failures during firmware download.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-64145?
CVE-2026-64145 is a high-severity memory corruption vulnerability in Linux kernel, published on 19 Jul 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
wifi: wilc1000: fix dma_buffer leak on bus acquire failure
wilc_wlan_firmware_download() allocates dma_buffer with kmalloc() at the top of the function and uses a 'fail:' label to free it via kfree(dma_buffer) on error.
All later error paths correctly use 'goto fail' to route through this cleanup. However, the early failure path after the first acquire_bus() call uses a bare 'return ret;', which leaks dma_buffer whenever the bus acquire fails.
Replace the early return with goto fail so the existing cleanup path runs.
Found via a custom Coccinelle semantic patch hunting for kmalloc'd locals leaked on early-return error paths in driver firmware-download code.
Weakness: CWE-787
Which versions are affected by CVE-2026-64145?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-64145?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-64145 being exploited?
There is no known exploitation of CVE-2026-64145 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2026-64145, DEBIAN-CVE-2026-64145, GHSA-jx6x-8px6-93f6, UBUNTU-CVE-2026-64145.