Cloudanix VulnDB

CVE-2026-68410

None

CVSS

—

EPSS

0.2%

Published

Aug 10, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in certain Linux wireless drivers fails to release temporary memory after loading firmware, which can slowly use up system resources on affected devices.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Theoretical
Impact
Denial Of Service
Component
OS kernel
Class
Memory Corruption
Remediation
Patch
Effort
Low
Patch risk
None

What it actually does

Failure to call release_firmware() on the single-stage firmware image after successful asynchronous load in helper_firmware_cb(), causing a memory leak in the USB firmware-download path of the libertas wireless driver.

Why it matters to the business

Gradual memory exhaustion on affected Linux systems during repeated firmware operations can lead to resource pressure, instability, or the need for reboots, particularly on devices using Libertas USB WiFi hardware.

How an attack unfolds

An attacker with the ability to repeatedly trigger the USB firmware-download path in the libertas driver can induce unbounded memory allocations that are never freed; the low EPSS and lack of known exploitation reflect the requirement for specific hardware and repeated successful async loads rather than a direct remote vector.

How to fix it

Apply the upstream kernel fix that inserts release_firmware() immediately after lbs_fw_loaded() returns inside helper_firmware_cb(); rebuild and deploy the patched kernel on all affected systems.

How to confirm the fix worked

Review the libertas driver source to confirm the release_firmware() call exists after lbs_fw_loaded(); perform targeted memory-leak testing or code review on the helper_firmware_cb() function during firmware load sequences.

Typical attack path

  1. Obtain access to a system with a compatible Libertas USB wireless adapter
  2. Repeatedly trigger asynchronous firmware loading events in the driver
  3. Allow the unfreed firmware allocations to accumulate over time

How to detect it

Inspect kernel logs for repeated libertas firmware-load events; correlate with steadily rising memory usage that is not reclaimed after successful lbs_fw_loaded() completion; review slab or kmemleak reports for unreleased firmware buffers.

What your security team should do

  • Prioritize kernel updates containing the memory-management fix for any systems exposing the libertas USB firmware path
  • Monitor memory consumption trends on hosts with Libertas wireless hardware
  • Disable or replace affected USB adapters where kernel updates cannot be applied promptly

The record

In the Linux kernel, the following vulnerability has been resolved: wifi: libertas: fix memory leak in helper_firmware_cb() helper_firmware_cb() neglects to free the single-stage firmware image after a successful async load, leading to a memory leak in the USB firmware-download path. Fix this memory leak by calling release_firmware() immediately after lbs_fw_loaded() returns. The bug was first flagged by an experimental analysis tool we are developing for kernel memory-management bugs while analyzing v6.13-rc1. The tool is still under development and is not yet publicly available. Manual inspection confirms that the bug is still present in the current wireless tree. An x86_64 allyesconfig build showed no new warnings. As we do not have compatible Libertas USB hardware for exercising this firmware-download path, no runtime testing was able to be performed.

Affected packages

Ecosystem Package Introduced Fixed