Memory Leak in Linux Kernel Affecting USB Firmware Download Path

CVE-2026-68410

What is CVE-2026-68410?

A memory leak has been identified in the Linux kernel's firmware handling for the Libertas USB devices. Specifically, the function responsible for managing firmware downloads, helper_firmware_cb(), fails to deallocate memory for a single-stage firmware image after successfully loading it asynchronously. This oversight leads to unnecessary memory consumption during firmware operations. Although the bug was detected through experimental kernel analysis tools, runtime testing could not be conducted due to the absence of compatible Libertas USB hardware. A fix has been proposed to ensure that memory is released immediately following firmware loading.

References