PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-23444 Linux CVE debrief

A memory leak vulnerability in the Linux kernel's mac80211 wireless subsystem could allow a local attacker to cause resource exhaustion. The flaw exists in ieee80211_tx_prepare_skb() where one of three error paths failed to free an sk_buff (socket buffer), leading to inconsistent memory handling. The fix ensures all error paths uniformly free the skb and removes redundant frees in callers (ath9k, mt76, mac80211_hwsim) to prevent double-free conditions.

Vendor
Linux
Product
Unknown
CVSS
HIGH 7.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-04-03
Original CVE updated
2026-07-24
Advisory published
2026-04-03
Advisory updated
2026-07-24

Who should care

Linux system administrators managing wireless-enabled endpoints; security teams tracking kernel memory exhaustion risks; organizations running IoT or embedded Linux devices with WiFi capabilities on affected kernel versions.

Technical summary

The ieee80211_tx_prepare_skb() function in net/mac80211/tx.c handles preparation of wireless transmission sk_buffs. Of its three error paths, only two invoked kfree_skb() when discarding a packet. The first error path (when ieee80211_tx_prepare() returns TX_DROP) leaked the skb. The resolution adds kfree_skb() to this path and documents that ieee80211_tx_prepare_skb() always consumes the skb, permitting removal of redundant frees in driver callers ath9k, mt76, and mac80211_hwsim. The vulnerability is local, requires low privileges, and has low attack complexity per CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

Defensive priority

HIGH

Recommended defensive actions

  • Apply the relevant stable kernel patch for your distribution or upgrade to a fixed kernel version (6.18.20 or later, 6.19.10 or later, or 7.0-rc8 or later).
  • For systems using long-term support kernels, monitor distribution security advisories for backported fixes.
  • Verify that wireless drivers ath9k, mt76, and mac80211_hwsim are updated if running custom kernel builds, as these callers had redundant frees removed.
  • Review system memory usage patterns on wireless-enabled Linux hosts for unexpected sk_buff accumulation that may indicate exploitation attempts.
  • Ensure kernel live-patching services (where available) are configured to deploy mac80211 subsystem fixes without requiring full reboots.

Evidence notes

CVE published 2026-04-03; modified 2026-06-01. NVD assigns CVSS 3.1 score 7.8 (HIGH). CWE-401 (Missing Release of Memory after Effective Lifetime). Affects Linux kernel versions from 3.13.1 through 6.18.19, 6.19 through 6.19.9, and 7.0-rc1 through 7.0-rc7. Multiple stable branch patches available via kernel.org git.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-23444 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-23444

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-23444 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-23444

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Mitigation or vendor reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/06e769dddcbeb3baf2ce346273b53dd61fdbecf4

    416baaa9-dc9f-4396-8d5f-8c081fb06d67 - Patch

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/3b4d27acafaeab478fd24f79ad6e593a892828b9

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Mitigation or vendor reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/50f1b690b4868923fbd242298def2fb88662f108

    416baaa9-dc9f-4396-8d5f-8c081fb06d67 - Patch

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/5ef8ca1c164786da24169af155c1ca1ff1353cf8

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/905ef207d5ed99ca64adfe39fba9ac46e434327a

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/9a779d1f480e83720b5384adf165604e7ee226bd

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Mitigation or vendor reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/d5ad6ab61cbd89afdb60881f6274f74328af3ee9

    416baaa9-dc9f-4396-8d5f-8c081fb06d67 - Patch

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.