In the Linux kernel, the following vulnerability has been resolved:

wifi: rtw88: usb: fix memory leaks on USB write failures

When rtw_usb_write_port() fails to submit a USB Request Block (URB)
(e.g., due to device disconnect or ENOMEM), the completion callback is
never executed.

Currently, the driver ignores the return value of rtw_usb_write_port()
in rtw_usb_write_data() and rtw_usb_tx_agg_skb(). Because these
functions rely on the completion callback to free the socket buffers
(skbs) and the transaction control block (txcb), a submission failure
results in:
1. A memory leak of the allocated skb in rtw_usb_write_data().
2. A memory leak of the txcb structure and all aggregated skbs in
rtw_usb_tx_agg_skb().

Fix this by checking the return value of rtw_usb_write_port(). If it
fails, explicitly free the skb in rtw_usb_write_data(), and properly
purge the tx_ack_queue and free the txcb in rtw_usb_tx_agg_skb().

The issue was discovered in practice during device disconnect/reconnect
scenarios and memory pressure conditions. Tested by verifying normal TX
operation continues after the fix without regressions.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
Linux Linux unaffected
Version Status Constraints
a82dfd33d1237f6c0fb8a7077022189d1fc7ec98 affected < 2b2060c2075a72bc2de43ce5e1b9347d6c5e27bb
a82dfd33d1237f6c0fb8a7077022189d1fc7ec98 affected < 53fed4061a09755de99c89fdc7fae5b794da455f
a82dfd33d1237f6c0fb8a7077022189d1fc7ec98 affected < 200d58c851b8f63f77a05570072dd20f79bc3681
a82dfd33d1237f6c0fb8a7077022189d1fc7ec98 affected < 8206d173d18ef5a077423119f4e9a93cb3a6f4eb
a82dfd33d1237f6c0fb8a7077022189d1fc7ec98 affected < 6b964941bbfe6e0f18b1a5e008486dbb62df440a
Linux Linux affected
Version Status Constraints
6.2 affected —
0 unaffected < 6.2
6.6.144 unaffected ≤ 6.6.*
6.12.95 unaffected ≤ 6.12.*
6.18.38 unaffected ≤ 6.18.*
7.1.3 unaffected ≤ 7.1.*
7.2-rc1 unaffected ≤ *

No data.

No data.

No data.

Project Subscriptions

Vendors Products
Linux Subscribe
Linux Kernel Subscribe
Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://git.kernel.org/stable/c/200d58c851b8f63f77a05570072dd20f79bc3681 cve-icon
https://git.kernel.org/stable/c/2b2060c2075a72bc2de43ce5e1b9347d6c5e27bb cve-icon
https://git.kernel.org/stable/c/53fed4061a09755de99c89fdc7fae5b794da455f cve-icon
https://git.kernel.org/stable/c/6b964941bbfe6e0f18b1a5e008486dbb62df440a cve-icon
https://git.kernel.org/stable/c/8206d173d18ef5a077423119f4e9a93cb3a6f4eb cve-icon
History

Sun, 19 Jul 2026 12:15:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: wifi: rtw88: usb: fix memory leaks on USB write failures When rtw_usb_write_port() fails to submit a USB Request Block (URB) (e.g., due to device disconnect or ENOMEM), the completion callback is never executed. Currently, the driver ignores the return value of rtw_usb_write_port() in rtw_usb_write_data() and rtw_usb_tx_agg_skb(). Because these functions rely on the completion callback to free the socket buffers (skbs) and the transaction control block (txcb), a submission failure results in: 1. A memory leak of the allocated skb in rtw_usb_write_data(). 2. A memory leak of the txcb structure and all aggregated skbs in rtw_usb_tx_agg_skb(). Fix this by checking the return value of rtw_usb_write_port(). If it fails, explicitly free the skb in rtw_usb_write_data(), and properly purge the tx_ack_queue and free the txcb in rtw_usb_tx_agg_skb(). The issue was discovered in practice during device disconnect/reconnect scenarios and memory pressure conditions. Tested by verifying normal TX operation continues after the fix without regressions.
Title wifi: rtw88: usb: fix memory leaks on USB write failures
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-07-19T12:02:18.751Z

Reserved: 2026-07-19T07:54:57.014Z

Link: CVE-2026-63821

cve-icon Vulnrichment

No data.

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses

No weakness.