Executive brief
The Linux kernel's Broadcom WiFi driver (brcmfmac) contains a memory leak in the brcmf_sdio_read_control() function where allocated buffer memory is not properly freed when certain error conditions occur. This can lead to gradual memory exhaustion and system performance degradation or denial of service over time.
Technical details
The vulnerability is a resource leak (memory leak) in the brcmf_sdio_read_control() function within the Broadcom brcmfmac SDIO driver. The root cause is that dynamically allocated buffer memory (buf) is not freed in certain error paths when the function exits early. The fix adds vfree() calls to ensure proper cleanup: the buffer is set to NULL after being stored in persistent state, and vfree() is called unconditionally at the function exit point (done label), ensuring memory is freed in all code paths. No authentication or network reachability is required; the leak occurs during normal WiFi driver operation when error conditions are encountered. The impact is memory exhaustion with repeated error occurrences, potentially causing system performance degradation or denial of service. A patch was committed upstream on 2026-08-06.
Affected products
- Linux Linux kernel affected versions prior to fix (2026-08-06)
Timeline
- 2026-09-11: disclosed: CVE-2026-80949 published
- 2026-08-06: patched: Fix committed upstream in Linux kernel
- 2026-08-03: other: Patch authored by Abdun Nihaal