Executive brief
The CA8210 IEEE 802.15.4 wireless device driver in the Linux kernel has a memory leak when SPI bus communication fails. Under sustained bus contention, the driver repeatedly allocates small memory buffers (~600 bytes each) that are never freed, causing incremental memory exhaustion and potential system instability or denial of service.
Technical details
The vulnerability is a resource leak (CWE-400/401) in the ca8210_spi_transfer() function in drivers/net/ieee802154/ca8210.c. The function allocates memory with kzalloc() for a control structure (cas_ctl) and depends entirely on an SPI completion callback to free it. However, the spi_async() API only invokes the completion callback on successful submission; on failure it returns an error code without queuing the callback. This orphans the allocated memory. Under sustained SPI bus contention, the driver's retry logic (looping on -EBUSY) in ca8210_spi_exchange() and the interrupt handler creates repeated leak cycles, each discarding ~600 bytes. The fix adds kfree(cas_ctl) to the spi_async() error path, ensuring proper cleanup regardless of submission success.
Affected products
- Linux Linux kernel affected versions include stable kernels back to linux-4.14.y and earlier; patched via commit e09390e439bd7cca30dd10893b1f64802961667a
Timeline
- 2026-08-15: disclosed
- 2026-04-21: patched: Upstream commit e09390e439bd7cca30dd10893b1f64802961667a