CVE-2025-68759

A vulnerability in the Linux kernel's rtl818x wireless driver (rtl8180_init_rx_ring()) can result in a memory leak. During the initialization of the receive ring, memory is allocated for socket buffers (skb) and DMA mappings in a loop. If an allocation fails, the previously successful allocations are not freed, causing memory to be unreclaimed [1].

The bug is triggered when an error occurs during the allocation loop, for example due to memory pressure or resource constraints. A local attacker with the ability to trigger driver initialization (e.g., by loading/unloading the module or bringing the interface up) could repeatedly cause allocation failures, leading to accumulation of leaked memory [1].

The impact is potential memory exhaustion, which can result in a denial of service (system hang or crash). The vulnerability does not allow code execution or privilege escalation.

The issue was fixed in the Linux kernel by redirecting the error path to the existing rtl8180_free_rx_ring() function, which properly frees all previously allocated resources. Additionally, the freed entry in priv->rx_buf is set to NULL to prevent double-free. Patches have been applied to stable kernels [1][2][3].