CVE-2026-68413
NoneCVSS
—
EPSS
0.2%
Published
Aug 10, 2026
CISA due date
—
Cloudanix analysis
A bug in the Linux kernel's wireless driver for certain older network cards could cause memory to be wasted during startup errors, potentially making the computer less stable over time.
- Exploitation
- Local Privilege
- Attacker needs
- Local User
- Complexity
- Theoretical
- Impact
- Denial Of Service
- Component
- OS kernel
- Class
- Memory Corruption
- Remediation
- Upgrade
- Effort
- Medium
- Patch risk
- Low
What it actually does
Potential memory leak in ipw2100 driver initialization when ipw2100_alloc_device allocations are not released on certain error paths in ipw2100_pci_init_one, including inline handling for pci_enable_device failure before priv is set.
Why it matters to the business
Repeated device probe or error conditions on affected hardware may gradually exhaust kernel memory, leading to reduced system stability or denial of service in environments relying on the ipw2100 wireless driver.
How an attack unfolds
An attacker with local access or the ability to trigger repeated PCI device initialization failures could cause the leak to accumulate, though the low EPSS and lack of known exploitation indicate this is primarily a stability issue rather than a direct remote code execution vector.
How to fix it
Update to a Linux kernel version containing the fix that replaces direct returns with goto error handling in ipw2100_pci_init_one and performs inline cleanup for early pci_enable_device failures.
How to confirm the fix worked
Confirm the presence of the corrected error handling logic using grep or source inspection for the goto conversion and inline pci_enable_device handling in ipw2100_pci_init_one; test device probe under simulated failure conditions to verify no leaks occur.
Typical attack path
- Trigger repeated error paths during ipw2100_pci_init_one execution
- Cause ipw2100_alloc_device to allocate memory without subsequent release
- Accumulate unreleased allocations until kernel memory pressure occurs
How to detect it
Review kernel logs for repeated ipw2100 initialization attempts and error paths; monitor slab or kmemleak reports for unreleased allocations originating from ipw2100_alloc_device during pci init failures.
What your security team should do
- Apply the kernel patch or upgrade to a fixed release as soon as available for systems using the ipw2100 driver
- Monitor kernel memory usage and OOM events on systems with this hardware
- Disable the ipw2100 module if the hardware is not required
The record
In the Linux kernel, the following vulnerability has been resolved: wifi: ipw2100: fix potential memory leak in ipw2100_pci_init_one() The memory allocated in the ipw2100_alloc_device() function is not freed in some of the error paths in ipw2100_pci_init_one(). Fix that by converting the direct return into a goto to the error path return. The error path when pci_enable_device() fails cannot jump to fail, since at this point priv is not set, so perform error handling inline.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|