Executive brief
A vulnerability was identified in the Linux kernel's WWAN (Wireless Wide Area Network) driver for certain modem interfaces. The issue involves a memory leak that occurs when the system fails to initialize properly, which could gradually consume system resources. While primarily a stability concern, such leaks can eventually lead to system crashes or performance degradation.
Technical details
A memory leak vulnerability exists in the Linux kernel within the 'net: wwan: iosm' driver. The root cause is located in the 'ipc_imem_init()' function, where memory allocated via 'ipc_protocol_init()' is not properly released if subsequent error paths are triggered during initialization. An attacker with local access could potentially exploit this by repeatedly triggering failed initialization sequences to exhaust kernel memory. The fix introduces a call to 'ipc_protocol_deinit()' within the error handling logic to ensure allocated resources are freed. The vulnerability affects versions starting from 5.14 and has been patched in various stable branches including 5.15.209, 6.1.175, 6.6.142, 6.12.92, and 6.18.34.
Affected products
- Linux Linux Kernel 5.14 to 6.18.34
Timeline
- 2026-07-19: disclosed
- 2026-07-19: advisory
References
- https://git.kernel.org/stable/c/583fd5a8fc797c8ecf2e1a7b923740c5e5734e85
- https://git.kernel.org/stable/c/6f63a60580ebdd9a1f22f89a84814d1fefe16b1c
- https://git.kernel.org/stable/c/8f764a7810a9f114313c439d25b11f4417c6e0dd
- https://git.kernel.org/stable/c/ba6d8643019c33428f7c0658863e80e0b04a70f4
- https://git.kernel.org/stable/c/c5d93b2c40355e999715262a824965aac025a427
- https://git.kernel.org/stable/c/f1a4d57847813fae42fbb7eb35f2dd48b9cff8a9
- https://git.kernel.org/stable/c/ffb6dbb49c96be82f07c7b112e3ebc3e6fdd8dd5