CVE-2026-23444
Use-After-Free Vulnerability in Linux mac80211 WiFi Driver
Publication date: 2026-04-03
Last updated on: 2026-04-27
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | 3.13 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | From 6.19 (inc) to 6.19.10 (exc) |
| linux | linux_kernel | From 3.13.1 (inc) to 6.18.20 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-401 | The product does not sufficiently track and release allocated memory after it has been used, making the memory unavailable for reallocation and reuse. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is in the Linux kernel's wifi mac80211 component. Specifically, the function ieee80211_tx_prepare_skb() has three error paths, but only two of them properly free the socket buffer (skb) when an error occurs. The first error path, when ieee80211_tx_prepare() returns TX_DROP, does not free the skb, which can lead to inconsistent memory management.
The fix involved adding a call to kfree_skb() in the first error path to ensure all three error paths free the skb consistently. Additionally, redundant frees in other callers were removed to avoid double-free issues. The skb ownership guarantee was also documented in the function's kernel documentation.
How can this vulnerability impact me? :
If the skb is not freed properly on all error paths, it can lead to memory leaks or inconsistent memory management within the kernel's wifi subsystem. This could potentially degrade system stability or performance over time due to resource exhaustion.
Additionally, improper freeing of memory buffers can sometimes lead to double-free vulnerabilities or use-after-free bugs, which might be exploitable to cause crashes or escalate privileges, although this specific CVE does not mention such exploitation.