CVE-2026-72004 Linux CVE debrief

Who should care

Linux kernel maintainers, mac80211 developers, and users of Linux systems with wireless networking capabilities should be aware of this vulnerability and take steps to assess and mitigate the risk.

Technical summary

The Linux kernel's mac80211 subsystem has a memory leak vulnerability. In the `ieee80211_register_hw` function, if `kmemdup` fails while copying supported band structures, the error path jumps to `fail_rate`, skipping `rate_control_deinitialize` and leaking the initialized `local->rate_ctrl`. This was fixed by adding a `fail_band` label to ensure proper rate-control cleanup. The bug was first flagged by an experimental analysis tool and manually confirmed to be present in v7.1-rc7. An x86_64 allyesconfig build showed no new warnings, but no runtime testing was performed due to lack of a suitable mac80211 device/driver combination. Linux kernel maintainers, mac80211 developers, and users of Linux systems with wireless networking capabilities should be aware of this vulnerability and take steps to assess and mitigate the risk.

Defensive priority

Medium

Recommended defensive actions

• Inventory and assess Linux kernel versions for potential vulnerability
• Apply patch or update to fixed kernel version
• Monitor for suspicious network activity
• Review system logs for error messages related to mac80211
• Implement compensating controls for network access

Evidence notes

The bug was identified by an experimental analysis tool and manually confirmed. The issue is caused by an error path in the `ieee80211_register_hw` function that skips `rate_control_deinitialize`, leading to a memory leak. The fix involves adding a new label `fail_band` to ensure proper cleanup.

Official resources