{"id":"CVE-2026-68410","title":"wifi: libertas: fix memory leak in helper_firmware_cb()","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: libertas: fix memory leak in helper_firmware_cb()\n\nhelper_firmware_cb() neglects to free the single-stage firmware image\nafter a successful async load, leading to…","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= 1dfba3060fe7ee03ccec25a91d35085142dfc295 < 6c1f54a04813676c5a2150d99331c8d21f199374","Linux >= 1dfba3060fe7ee03ccec25a91d35085142dfc295 < 7f28722b3e4e0c8d49c859fea4a9b1fa13b5ae06","Linux >= 1dfba3060fe7ee03ccec25a91d35085142dfc295 < ce829286f4935f1eb6b5dcb64da02910ce149c76","Linux >= 1dfba3060fe7ee03ccec25a91d35085142dfc295 < d497b7566e74920acfe283dd6b2cbf1682890796","Linux >= 1dfba3060fe7ee03ccec25a91d35085142dfc295 < eaeb1d74a47fc4864f2c754c0b9d654a9b7dc55c","Linux >= 1dfba3060fe7ee03ccec25a91d35085142dfc295 < 6cda91bbb8dc3d22ef0323008a12dcf73a5129da","Linux >= 1dfba3060fe7ee03ccec25a91d35085142dfc295 < 644640cde2fb216e6567de5eee780a38dbc95928","Linux >= 1dfba3060fe7ee03ccec25a91d35085142dfc295 < 63c2391deefb31e1b801b7f32bd502ca4808639b","Linux 3.13"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-11-06T16:48:53.202646Z"},"published":"2026-08-10","updated":"2026-11-06","sourceUpdated":"2026-11-06T16:55:15.818Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-68410","references":[{"url":"https://git.kernel.org/stable/c/6c1f54a04813676c5a2150d99331c8d21f199374"},{"url":"https://git.kernel.org/stable/c/7f28722b3e4e0c8d49c859fea4a9b1fa13b5ae06"},{"url":"https://git.kernel.org/stable/c/ce829286f4935f1eb6b5dcb64da02910ce149c76"},{"url":"https://git.kernel.org/stable/c/d497b7566e74920acfe283dd6b2cbf1682890796"},{"url":"https://git.kernel.org/stable/c/eaeb1d74a47fc4864f2c754c0b9d654a9b7dc55c"},{"url":"https://git.kernel.org/stable/c/6cda91bbb8dc3d22ef0323008a12dcf73a5129da"},{"url":"https://git.kernel.org/stable/c/644640cde2fb216e6567de5eee780a38dbc95928"},{"url":"https://git.kernel.org/stable/c/63c2391deefb31e1b801b7f32bd502ca4808639b"}],"tags":["cve.org"],"epss":0.00216,"epssPercentile":0.12132,"ingestedAt":"2026-11-06T18:00:12.605Z","slug":"CVE-2026-68410","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nwifi: libertas: fix memory leak in helper_firmware_cb()\n\nhelper_firmware_cb() neglects to free the single-stage firmware image\nafter a successful async load, leading to a memory leak in the USB\nfirmware-download path.\n\nFix this memory leak by calling release_firmware() immediately after\nlbs_fw_loaded() returns.\n\nThe bug was first flagged by an experimental analysis tool we are\ndeveloping for kernel memory-management bugs while analyzing\nv6.13-rc1. The tool is still under development and is not yet publicly\navailable. Manual inspection confirms that the bug is still present in\nthe current wireless tree.\n\nAn x86_64 allyesconfig build showed no new warnings. As we do not have\ncompatible Libertas USB hardware for exercising this firmware-download\npath, no runtime testing was able to be performed.\n\n## Affected\n\n- `Linux >= 1dfba3060fe7ee03ccec25a91d35085142dfc295 < 6c1f54a04813676c5a2150d99331c8d21f199374`\n- `Linux >= 1dfba3060fe7ee03ccec25a91d35085142dfc295 < 7f28722b3e4e0c8d49c859fea4a9b1fa13b5ae06`\n- `Linux >= 1dfba3060fe7ee03ccec25a91d35085142dfc295 < ce829286f4935f1eb6b5dcb64da02910ce149c76`\n- `Linux >= 1dfba3060fe7ee03ccec25a91d35085142dfc295 < d497b7566e74920acfe283dd6b2cbf1682890796`\n- `Linux >= 1dfba3060fe7ee03ccec25a91d35085142dfc295 < eaeb1d74a47fc4864f2c754c0b9d654a9b7dc55c`\n- `Linux >= 1dfba3060fe7ee03ccec25a91d35085142dfc295 < 6cda91bbb8dc3d22ef0323008a12dcf73a5129da`\n- `Linux >= 1dfba3060fe7ee03ccec25a91d35085142dfc295 < 644640cde2fb216e6567de5eee780a38dbc95928`\n- `Linux >= 1dfba3060fe7ee03ccec25a91d35085142dfc295 < 63c2391deefb31e1b801b7f32bd502ca4808639b`\n- `Linux 3.13`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}