wifi: rtw88: usb: fix memory leaks on USB write failures
Summary
| CVE | CVE-2026-63821 |
|---|---|
| State | PUBLISHED |
| Assigner | Linux |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-07-19 12:16:55 UTC |
| Updated | 2026-07-19 12:16:55 UTC |
| Description | In the Linux kernel, the following vulnerability has been resolved: wifi: rtw88: usb: fix memory leaks on USB write failures When rtw_usb_write_port() fails to submit a USB Request Block (URB) (e.g., due to device disconnect or ENOMEM), the completion callback is never executed. Currently, the driver ignores the return value of rtw_usb_write_port() in rtw_usb_write_data() and rtw_usb_tx_agg_skb(). Because these functions rely on the completion callback to free the socket buffers (skbs) and the transaction control block (txcb), a submission failure results in: 1. A memory leak of the allocated skb in rtw_usb_write_data(). 2. A memory leak of the txcb structure and all aggregated skbs in rtw_usb_tx_agg_skb(). Fix this by checking the return value of rtw_usb_write_port(). If it fails, explicitly free the skb in rtw_usb_write_data(), and properly purge the tx_ack_queue and free the txcb in rtw_usb_tx_agg_skb(). The issue was discovered in practice during device disconnect/reconnect scenarios and memory pressure conditions. Tested by verifying normal TX operation continues after the fix without regressions. |
Risk And Classification
EPSS: 0.001570000 probability, percentile 0.052460000 (date 2026-07-20)
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Linux | Linux | affected a82dfd33d1237f6c0fb8a7077022189d1fc7ec98 2b2060c2075a72bc2de43ce5e1b9347d6c5e27bb git | Not specified |
| CNA | Linux | Linux | affected a82dfd33d1237f6c0fb8a7077022189d1fc7ec98 53fed4061a09755de99c89fdc7fae5b794da455f git | Not specified |
| CNA | Linux | Linux | affected a82dfd33d1237f6c0fb8a7077022189d1fc7ec98 200d58c851b8f63f77a05570072dd20f79bc3681 git | Not specified |
| CNA | Linux | Linux | affected a82dfd33d1237f6c0fb8a7077022189d1fc7ec98 8206d173d18ef5a077423119f4e9a93cb3a6f4eb git | Not specified |
| CNA | Linux | Linux | affected a82dfd33d1237f6c0fb8a7077022189d1fc7ec98 6b964941bbfe6e0f18b1a5e008486dbb62df440a git | Not specified |
| CNA | Linux | Linux | affected 6.2 | Not specified |
| CNA | Linux | Linux | unaffected 6.2 semver | Not specified |
| CNA | Linux | Linux | unaffected 6.6.144 6.6.* semver | Not specified |
| CNA | Linux | Linux | unaffected 6.12.95 6.12.* semver | Not specified |
| CNA | Linux | Linux | unaffected 6.18.38 6.18.* semver | Not specified |
| CNA | Linux | Linux | unaffected 7.1.3 7.1.* semver | Not specified |
| CNA | Linux | Linux | unaffected 7.2-rc1 * original_commit_for_fix | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| git.kernel.org/stable/c/6b964941bbfe6e0f18b1a5e008486dbb62df440a | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | git.kernel.org | |
| git.kernel.org/stable/c/200d58c851b8f63f77a05570072dd20f79bc3681 | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | git.kernel.org | |
| git.kernel.org/stable/c/2b2060c2075a72bc2de43ce5e1b9347d6c5e27bb | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | git.kernel.org | |
| git.kernel.org/stable/c/8206d173d18ef5a077423119f4e9a93cb3a6f4eb | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | git.kernel.org | |
| git.kernel.org/stable/c/53fed4061a09755de99c89fdc7fae5b794da455f | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | git.kernel.org | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.