CVE-2026-64145

wifi: wilc1000: fix dma_buffer leak on bus acquire failure

State
Published
Severity
Not scored
Published
Jul 19, 2026
Updated
Jul 19, 2026
Reserved
Jul 19, 2026

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

wifi: wilc1000: fix dma_buffer leak on bus acquire failure

wilc_wlan_firmware_download() allocates dma_buffer with kmalloc() at the top of the function and uses a 'fail:' label to free it via kfree(dma_buffer) on error.

All later error paths correctly use 'goto fail' to route through this cleanup. However, the early failure path after the first acquire_bus() call uses a bare 'return ret;', which leaks dma_buffer whenever the bus acquire fails.

Replace the early return with goto fail so the existing cleanup path runs.

Found via a custom Coccinelle semantic patch hunting for kmalloc'd locals leaked on early-return error paths in driver firmware-download code.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • 1241c5650ff7a0236cebb89acca8aade48839fd6 to before 95c82d498d74c4e587db30021ca1aec90e29b5a5Affected
  • 1241c5650ff7a0236cebb89acca8aade48839fd6 to before 32d7584441b9ecb279a03653b432612546e5efbeAffected
  • 1241c5650ff7a0236cebb89acca8aade48839fd6 to before dd7b6a8671939708cc4b7a46786d8c11297e8f69Affected
LinuxLinux
  • 6.13Affected
  • before 6.13Not affected
  • 6.18.34 through 6.18.*Not affected
  • 7.0.11 through 7.0.*Not affected
  • 7.1 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.