Cloudanix VulnDB

CVE-2026-98710

None

CVSS

—

EPSS

0.2%

Published

Oct 18, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A small memory leak in an older wireless driver can slowly use up system memory each time the hardware is removed, eventually making the computer slow or unstable.

Exploitation
Other
Attacker needs
Local User
Complexity
Theoretical
Impact
Denial Of Service
Component
OS kernel
Class
Other
Remediation
Patch
Effort
Low
Patch risk
Low

What it actually does

Memory leak of EEPROM data buffer allocated during successful PCI probe but never released on device removal in the iwlegacy 3945 driver.

Why it matters to the business

Repeated insertion and removal of the affected wireless hardware or module reload cycles gradually exhaust kernel memory, leading to performance degradation or system instability over time on affected Linux systems.

How an attack unfolds

An attacker with local access causes repeated successful probe and remove cycles (for example by loading and unloading the driver or triggering PCI hotplug events) to accumulate leaked EEPROM allocations until memory pressure impacts the system.

How to fix it

Apply the upstream fix that adds il_eeprom_free() call inside il3945_pci_remove() before releasing the mac80211 hardware structure; rebuild and deploy the patched kernel.

How to confirm the fix worked

Inspect the il3945_pci_remove() function in the iwlegacy source to confirm the EEPROM free occurs; monitor kernel memory usage during repeated device remove operations after patching.

Typical attack path

  1. Obtain local access or ability to trigger driver load/unload
  2. Trigger il3945_pci_probe to allocate EEPROM data
  3. Trigger il3945_pci_remove without the missing free
  4. Repeat to accumulate kernel memory leaks

How to detect it

Review kernel logs for repeated probe/remove events on the 3945 device and correlate with rising memory usage in slab caches; use kmemleak or similar tools to identify unreleased EEPROM buffers.

What your security team should do

  • Prioritize patching systems that use the iwlegacy 3945 driver
  • Monitor kernel slab or kmemleak reports for unexpected EEPROM allocations
  • Limit unprivileged module loading where feasible until patched

The record

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlegacy: 3945: free EEPROM data on remove il3945_pci_probe() calls il_eeprom_init(), which allocates memory for the EEPROM data. The probe failure paths release this allocation with il_eeprom_free(), but the remove path does not free it after a successful probe. As a result, the EEPROM data is leaked when the PCI device is removed. Free the EEPROM data in il3945_pci_remove() before releasing the mac80211 hardware structure. This issue was found by manual code inspection.

Affected packages

Ecosystem Package Introduced Fixed