CVE-2026-68410 is a vulnerability in Linux Kernel
Published on August 10, 2026
wifi: libertas: fix memory leak in helper_firmware_cb()
In the Linux kernel, the following vulnerability has been resolved:
wifi: libertas: fix memory leak in helper_firmware_cb()
helper_firmware_cb() neglects to free the single-stage firmware image
after a successful async load, leading to a memory leak in the USB
firmware-download path.
Fix this memory leak by calling release_firmware() immediately after
lbs_fw_loaded() returns.
The bug was first flagged by an experimental analysis tool we are
developing for kernel memory-management bugs while analyzing
v6.13-rc1. The tool is still under development and is not yet publicly
available. Manual inspection confirms that the bug is still present in
the current wireless tree.
An x86_64 allyesconfig build showed no new warnings. As we do not have
compatible Libertas USB hardware for exercising this firmware-download
path, no runtime testing was able to be performed.
Products Associated with CVE-2026-68410
Want to know whenever a new CVE is published for Linux Kernel? stack.watch will email you.
Affected Versions
Linux:- Version 1dfba3060fe7ee03ccec25a91d35085142dfc295 and below d497b7566e74920acfe283dd6b2cbf1682890796 is affected.
- Version 1dfba3060fe7ee03ccec25a91d35085142dfc295 and below eaeb1d74a47fc4864f2c754c0b9d654a9b7dc55c is affected.
- Version 1dfba3060fe7ee03ccec25a91d35085142dfc295 and below 6cda91bbb8dc3d22ef0323008a12dcf73a5129da is affected.
- Version 1dfba3060fe7ee03ccec25a91d35085142dfc295 and below 644640cde2fb216e6567de5eee780a38dbc95928 is affected.
- Version 1dfba3060fe7ee03ccec25a91d35085142dfc295 and below 63c2391deefb31e1b801b7f32bd502ca4808639b is affected.
- Version 3.13 is affected.
- Before 3.13 is unaffected.
- Version 6.6.148, <= 6.6.* is unaffected.
- Version 6.12.101, <= 6.12.* is unaffected.
- Version 6.18.42, <= 6.18.* is unaffected.
- Version 7.1.6, <= 7.1.* is unaffected.
- Version 7.2-rc4, <= * is unaffected.