CVE-2026-72004

Received Received - Intake

Memory Leak in Linux Kernel mac80211 Subsystem

Publication date: 2026-08-15

Last updated on: 2026-08-17

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix memory leak in ieee80211_register_hw() If kmemdup() fails while copying supported band structures, the error path jumps to fail_rate. This skips rate_control_deinitialize() and leaks the initialized local->rate_ctrl. Fix this by adding a fail_band label that shares the rate-control cleanup path before falling through to the remaining teardown. The bug was first flagged by an experimental analysis tool we are developing for kernel memory-management bugs while analyzing v6.13-rc1. The tool is still under development and is not yet publicly available. Manual inspection confirms that the bug is still present in v7.1-rc7. An x86_64 allyesconfig build showed no new warnings. As we do not have a suitable mac80211 device/driver combination to test with, no runtime testing was able to be performed.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-17

Generated

2026-09-04

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-72004

EUVD

EUVD-2026-59103

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	From 6.13-rc1 (inc) to 7.1-rc7 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a memory leak vulnerability in the Linux kernel's WiFi subsystem. When copying supported band structures fails, the error handling skips cleanup of rate control resources, causing a memory leak in the local rate control structure.

Detection Guidance

This vulnerability is specific to the Linux kernel's mac80211 subsystem and involves a memory leak during WiFi driver initialization. Detection requires kernel source code analysis or runtime memory leak detection tools. No direct commands are provided in the context to detect this issue.

Impact Analysis

The memory leak could gradually consume system memory over time, potentially leading to degraded performance or system instability if the affected WiFi subsystem is heavily used.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR or HIPAA as it is a memory leak in the Linux kernel's wifi subsystem. Compliance impacts would depend on specific implementations and whether the leak leads to data exposure or system instability.

Mitigation Strategies

Apply the kernel patch that fixes the memory leak in ieee80211_register_hw(). Update to a kernel version that includes the fix. Monitor kernel security advisories for updates related to mac80211 or WiFi drivers.

Hi! I’m here to help you understand CVE-2026-72004. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70