CVE-2026-63821
Received Received - Intake

Memory Leak in Linux Kernel WiFi Driver

Publication date: 2026-07-19

Last updated on: 2026-07-19

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: wifi: rtw88: usb: fix memory leaks on USB write failures When rtw_usb_write_port() fails to submit a USB Request Block (URB) (e.g., due to device disconnect or ENOMEM), the completion callback is never executed. Currently, the driver ignores the return value of rtw_usb_write_port() in rtw_usb_write_data() and rtw_usb_tx_agg_skb(). Because these functions rely on the completion callback to free the socket buffers (skbs) and the transaction control block (txcb), a submission failure results in: 1. A memory leak of the allocated skb in rtw_usb_write_data(). 2. A memory leak of the txcb structure and all aggregated skbs in rtw_usb_tx_agg_skb(). Fix this by checking the return value of rtw_usb_write_port(). If it fails, explicitly free the skb in rtw_usb_write_data(), and properly purge the tx_ack_queue and free the txcb in rtw_usb_tx_agg_skb(). The issue was discovered in practice during device disconnect/reconnect scenarios and memory pressure conditions. Tested by verifying normal TX operation continues after the fix without regressions.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-19
Last Modified
2026-07-19
Generated
2026-07-20
AI Q&A
2026-07-19
EPSS Evaluated
N/A
NVD
CVE-2026-63821
EUVD
EUVD-2026-45487

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
linux kernel *
linux_kernel linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel's rtw88 USB WiFi driver causes memory leaks when USB write operations fail. Normally, the driver frees memory after data transmission via a completion callback, but if the write fails (e.g., device disconnect or out of memory), the callback never runs. This leaves allocated socket buffers (skbs) and transaction control blocks (txcb) unfreed, wasting system memory.

Detection Guidance

This vulnerability involves memory leaks in the Linux kernel's rtw88 USB WiFi driver during USB write failures. Detection requires checking for memory leaks in the kernel logs or using memory monitoring tools like 'slabtop' or 'vmstat' to observe abnormal memory usage patterns in the WiFi subsystem.

Impact Analysis

This vulnerability can cause your system to gradually consume more memory over time, potentially leading to performance degradation or crashes if memory is exhausted. It may occur during normal WiFi operations, especially when devices disconnect or reconnect, or under memory pressure conditions.

Compliance Impact

This vulnerability causes memory leaks in the Linux kernel's wifi driver (rtw88) during USB write failures. While it does not directly impact data privacy or security controls, memory leaks can lead to system instability or crashes, potentially disrupting compliance with availability requirements in standards like GDPR or HIPAA.

Mitigation Strategies

Apply the kernel patch that fixes the memory leak in the rtw88 USB driver. Update to a Linux kernel version that includes the fix for CVE-2026-63821. If immediate patching is not possible, consider disabling the affected WiFi driver or using alternative network interfaces until the patch is applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-63821. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart