Linux Kernel CVE-2026-64179

The vulnerability resides in the Intel IOSM (IPC over Shared Memory) WWAN modem driver located in net/wwan/iosm/ of the Linux kernel source tree. CWE-401 (Missing Release of Memory after Effective Lifetime) identifies the root cause: ipc_imem_init() calls ipc_protocol_init() to allocate memory for IPC protocol structures, but on error paths that arise later in the same function, the corresponding deallocation function ipc_protocol_deinit() is never invoked, resulting in a kernel memory leak. The driver manages IPC communication between the host and Intel cellular modem hardware. The affected CPE is cpe:2.3:a:linux:linux:* across all stable kernel branches that include this driver, which was introduced at commit 3670970dd8c661c10c10c300d726f59428eaad32, corresponding to the Linux 5.14 development cycle. It is worth noting that the 'Information Disclosure' tag appearing in third-party intelligence sources (VulDB, EUVD) is inconsistent with the CVSS C:N metric and the CVE description - the actual impact class is availability (memory exhaustion), not data disclosure, and that tag should be treated as a tagging artifact.