Skip to main content

Linux Kernel EUVDEUVD-2026-45864

| CVE-2026-64179 MEDIUM
Memory Leak (CWE-401)
2026-07-19 Linux GHSA-777r-4xhv-7pp2
Information Disclosure Linux Red Hat Suse
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
5.5 MEDIUM

Local driver memory leak requires low-privilege local access and specific hardware; no confidentiality or integrity impact, only availability degradation from kernel memory exhaustion.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
3.3 LOW
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Red Hat
5.5 LOW
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

5
Analysis Generated
Aug 12, 2026 - 15:45 vuln.today
CVSS changed
Aug 12, 2026 - 15:37 NVD
5.5 (MEDIUM)
Patch available
Jul 19, 2026 - 17:03 EUVD
CVE Published
Jul 19, 2026 - 15:41 cve.org
UNKNOWN (no severity yet)
CVE Published
Jul 19, 2026 - 15:41 nvd
MEDIUM 5.5

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

net: wwan: iosm: fix potential memory leaks in ipc_imem_init()

The memory allocated in ipc_protocol_init() is not freed on the error paths that follow in ipc_imem_init(). Fix that by calling the corresponding release function ipc_protocol_deinit() in the error path.

AnalysisAI

Memory exhaustion in the Linux kernel WWAN IOSM driver allows a local low-privileged attacker to deplete kernel memory by repeatedly triggering error paths in ipc_imem_init() where memory allocated by ipc_protocol_init() is never released. Affected systems running kernel versions from 5.14 through the unpatched branches of 5.15, 6.1, 6.6, 6.12, 6.18, 7.0, and pre-7.1 with Intel WWAN IOSM modem hardware loaded are vulnerable to availability-impact memory exhaustion. No public exploit exists and EPSS probability sits at 0.16% (6th percentile), indicating negligible real-world exploitation likelihood; however, patched stable releases are available across all major kernel branches.

Technical ContextAI

The vulnerability resides in the Intel IOSM (IPC over Shared Memory) WWAN modem driver located in net/wwan/iosm/ of the Linux kernel source tree. CWE-401 (Missing Release of Memory after Effective Lifetime) identifies the root cause: ipc_imem_init() calls ipc_protocol_init() to allocate memory for IPC protocol structures, but on error paths that arise later in the same function, the corresponding deallocation function ipc_protocol_deinit() is never invoked, resulting in a kernel memory leak. The driver manages IPC communication between the host and Intel cellular modem hardware. The affected CPE is cpe:2.3:a:linux:linux:* across all stable kernel branches that include this driver, which was introduced at commit 3670970dd8c661c10c10c300d726f59428eaad32, corresponding to the Linux 5.14 development cycle. It is worth noting that the 'Information Disclosure' tag appearing in third-party intelligence sources (VulDB, EUVD) is inconsistent with the CVSS C:N metric and the CVE description - the actual impact class is availability (memory exhaustion), not data disclosure, and that tag should be treated as a tagging artifact.

RemediationAI

The primary fix is upgrading to a patched Linux kernel version appropriate to your stable branch: 5.15.209, 6.1.175, 6.6.142, 6.12.92, 6.18.34, 7.0.11, or 7.1. Upstream fix commits are confirmed on the kernel.org stable trees - key patch commits include https://git.kernel.org/stable/c/f1a4d57847813fae42fbb7eb35f2dd48b9cff8a9, https://git.kernel.org/stable/c/ba6d8643019c33428f7c0658863e80e0b04a70f4, https://git.kernel.org/stable/c/6f63a60580ebdd9a1f22f89a84814d1fefe16b1c, and several others listed in the references. Ubuntu users should apply USN-8575-1 via standard apt update channels. As a compensating control on systems where the IOSM driver is not required by the hardware, blacklisting the kernel module by adding blacklist iosm to /etc/modprobe.d/blacklist.conf and regenerating the initramfs eliminates the attack surface entirely with no functional impact on systems lacking Intel WWAN modems; this is a zero-trade-off mitigation for the vast majority of Linux deployments. Patching remains the definitive resolution.

Same weakness CWE-401 – Memory Leak

View all
CVE-2020-13934 HIGH
7.5
CVE-2016-4232 HIGH POC
7.5
CVE-2024-25450 HIGH POC
8.8
CVE-2023-33718 HIGH POC
8.8
CVE-2019-6128 HIGH POC
8.8
CVE-2026-67183 HIGH POC
8.7
CVE-2023-34451 HIGH POC
8.2
CVE-2023-41484 HIGH POC
8.1

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Low
Product Status
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise Module for Basesystem 15 SP7 Affected
SUSE Linux Enterprise Server 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Server for SAP Applications 15 SP7 Affected

Share

EUVD-2026-45864 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy