Skip to main content

Linux wilc1000 CVE-2026-64145

| EUVDEUVD-2026-45830 HIGH
Out-of-bounds Write (CWE-787)
2026-07-19 Linux GHSA-jx6x-8px6-93f6
Buffer Overflow Linux Memory Corruption Red Hat Suse
High
Disputed · 7.8 NVD
Share

Severity by source

Sources disagree (Low–High)
NVD PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
3.3 LOW

Memory leak with no direct data exposure or write primitive; availability impact is low since exhaustion requires many repeated failures on niche embedded hardware.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
SUSE
4.7 MEDIUM
AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Red Hat
5.5 LOW
qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Aug 17, 2026 - 22:01 vuln.today
CVSS changed
Aug 17, 2026 - 19:52 NVD
7.8 (HIGH)
Patch available
Jul 19, 2026 - 17:03 EUVD
CVE Published
Jul 19, 2026 - 15:40 nvd
HIGH 7.8
CVE Published
Jul 19, 2026 - 15:40 cve.org
UNKNOWN (no severity yet)

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

wifi: wilc1000: fix dma_buffer leak on bus acquire failure

wilc_wlan_firmware_download() allocates dma_buffer with kmalloc() at the top of the function and uses a 'fail:' label to free it via kfree(dma_buffer) on error.

All later error paths correctly use 'goto fail' to route through this cleanup. However, the early failure path after the first acquire_bus() call uses a bare 'return ret;', which leaks dma_buffer whenever the bus acquire fails.

Replace the early return with goto fail so the existing cleanup path runs.

Found via a custom Coccinelle semantic patch hunting for kmalloc'd locals leaked on early-return error paths in driver firmware-download code.

AnalysisAI

Memory leak in the Linux kernel's wilc1000 WiFi driver exposes systems with Microchip WILC1000 adapters to kernel heap exhaustion. The function wilc_wlan_firmware_download() allocates a DMA buffer via kmalloc() but an early-return path after the first acquire_bus() call bypasses the established cleanup label, leaking the buffer unconditionally on bus acquire failures. No public exploit has been identified and EPSS probability is extremely low (0.17%, 6th percentile), but repeated triggering on affected embedded hardware could degrade system stability. Upstream stable fixes are available as confirmed kernel commits targeting 6.18.x, 7.0.x, and 7.1.

Technical ContextAI

The wilc1000 is a Microchip (formerly Atmel) WILC1000 IEEE 802.11 b/g/n WiFi SoC, primarily used in embedded Linux systems. The driver resides in drivers/net/wireless/microchip/wilc1000/ in the Linux kernel. The vulnerable code path is in wilc_wlan_firmware_download(): a DMA buffer is allocated with kmalloc() at function entry, and a 'fail:' label handles cleanup via kfree(). All error paths correctly use 'goto fail' except for one early return after acquire_bus() fails, which bypasses kfree() entirely. The CPE cpe:2.3:a:linux:linux indicates the Linux kernel source tree broadly, but the impact is scoped to systems with wilc1000 hardware. The assigned CWE-787 (Out-of-Bounds Write) is a significant mismatch with the described vulnerability - a memory leak is canonically CWE-401 (Missing Release of Memory after Effective Lifetime); this discrepancy should be treated as a data quality issue from the reporting source.

RemediationAI

The primary fix is to update the Linux kernel to a patched stable release: 6.18.34, 7.0.11, or 7.1 as released upstream. The specific fix commits at git.kernel.org/stable (95c82d4, dd7b6a8, 32d7584) replace the bare 'return ret;' with 'goto fail;' in wilc_wlan_firmware_download(), ensuring the existing kfree(dma_buffer) cleanup always executes. Ubuntu users should apply the packages addressed in USN-8593-1 (https://ubuntu.com/security/notices/USN-8593-1). As a workaround, systems not requiring the wilc1000 driver can blacklist the wilc1000 kernel module (echo 'blacklist wilc1000' >> /etc/modprobe.d/blacklist.conf) with no functional impact on systems without the Microchip WILC1000 hardware, eliminating exposure entirely. No confidentiality or integrity compensating controls are needed given the actual impact is limited to memory leak.

Same weakness CWE-787 – Out-of-bounds Write

View all
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2012-1889 HIGH POC
8.8
CVE-2010-3333 HIGH POC
7.8
CVE-2014-1761 HIGH POC
7.8
CVE-2009-3129 HIGH POC
7.8
CVE-2021-1732 HIGH POC
7.8
CVE-2013-3346 CRITICAL POC
9.8

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 16.0 Not-Affected

Share

CVE-2026-64145 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy