Memory Leak Vulnerability in Linux Kernel affecting rtw88 USB WiFi Drivers

CVE-2026-63821

What is CVE-2026-63821?

This vulnerability is associated with the rtw88 USB WiFi driver in the Linux kernel, where failures in USB Request Block (URB) submissions during write operations can lead to memory leaks. Specifically, when the rtw_usb_write_port() function encounters issues (like device disconnection or memory pressure), the callback intended to free allocated resources is never executed. Consequently, memory leaks occur in both rtw_usb_write_data() and rtw_usb_tx_agg_skb(). The driver’s failure to check for submit errors means socket buffers and transaction control blocks are not purged correctly when issues arise, potentially leading to resource exhaustion. A fix has been implemented to ensure these resources are freed appropriately upon submission failure.

References