CVE-2026-68410: wifi: libertas: fix memory leak in helper_firmware_cb()

From: Greg Kroah-Hartman <[email protected]>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

wifi: libertas: fix memory leak in helper_firmware_cb()

helper_firmware_cb() neglects to free the single-stage firmware image
after a successful async load, leading to a memory leak in the USB
firmware-download path.

Fix this memory leak by calling release_firmware() immediately after
lbs_fw_loaded() returns.

The bug was first flagged by an experimental analysis tool we are
developing for kernel memory-management bugs while analyzing
v6.13-rc1. The tool is still under development and is not yet publicly
available. Manual inspection confirms that the bug is still present in
the current wireless tree.

An x86_64 allyesconfig build showed no new warnings. As we do not have
compatible Libertas USB hardware for exercising this firmware-download
path, no runtime testing was able to be performed.

The Linux kernel CVE team has assigned CVE-2026-68410 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 3.13 with commit 1dfba3060fe7ee03ccec25a91d35085142dfc295 and fixed in 6.6.148 with commit d497b7566e74920acfe283dd6b2cbf1682890796
	Issue introduced in 3.13 with commit 1dfba3060fe7ee03ccec25a91d35085142dfc295 and fixed in 6.12.101 with commit eaeb1d74a47fc4864f2c754c0b9d654a9b7dc55c
	Issue introduced in 3.13 with commit 1dfba3060fe7ee03ccec25a91d35085142dfc295 and fixed in 6.18.42 with commit 6cda91bbb8dc3d22ef0323008a12dcf73a5129da
	Issue introduced in 3.13 with commit 1dfba3060fe7ee03ccec25a91d35085142dfc295 and fixed in 7.1.6 with commit 644640cde2fb216e6567de5eee780a38dbc95928
	Issue introduced in 3.13 with commit 1dfba3060fe7ee03ccec25a91d35085142dfc295 and fixed in 7.2-rc4 with commit 63c2391deefb31e1b801b7f32bd502ca4808639b

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-68410
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/net/wireless/marvell/libertas/firmware.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/d497b7566e74920acfe283dd6b2cbf1682890796
	https://git.kernel.org/stable/c/eaeb1d74a47fc4864f2c754c0b9d654a9b7dc55c
	https://git.kernel.org/stable/c/6cda91bbb8dc3d22ef0323008a12dcf73a5129da
	https://git.kernel.org/stable/c/644640cde2fb216e6567de5eee780a38dbc95928
	https://git.kernel.org/stable/c/63c2391deefb31e1b801b7f32bd502ca4808639b