Executive brief
The Linux kernel's FireWire driver contains a memory leak in the topology tree building function. When the build_tree() function encounters invalid data in a FireWire self-ID sequence, it could return early without freeing allocated node structures, leaving orphaned memory allocations. While the direct security impact is limited to resource exhaustion on systems with FireWire hardware, systems exposed to malformed FireWire packets could experience incremental memory depletion.
Technical details
This is a memory leak vulnerability in the firewire/core-topology.c driver, specifically in the build_tree() function. The vulnerable component processes FireWire self-ID sequences to construct a device topology tree. When validation fails (invalid extended self-IDs, PHY ID mismatch, parent port inconsistency, or memory allocation failure), the function would return NULL without releasing intermediate node allocations. An attacker with network access to a FireWire bus or the ability to inject crafted self-ID packets could trigger these error paths repeatedly, causing kernel memory exhaustion. The fix adds an error handler that properly traverses and frees all allocated node instances before returning. Patch is available in commit 05bfb1327dc5fb61528bab31cd8f0c1e4bddec23.
Affected products
- Linux Linux Kernel All versions with FireWire support
Timeline
- 2026-08-11: disclosed: Fix authored by Takashi Sakamoto
- 2026-09-14: patched: Merged into stable kernel trees
- 2026-09-17: other: CVE-2026-90213 published