CVE-2026-63821 (GCVE-0-2026-63821)

Vulnerability from cvelistv5 – Published: 2026-07-19 12:02 – Updated: 2026-07-19 12:02
VLAI
Title
wifi: rtw88: usb: fix memory leaks on USB write failures
Summary
In the Linux kernel, the following vulnerability has been resolved: wifi: rtw88: usb: fix memory leaks on USB write failures When rtw_usb_write_port() fails to submit a USB Request Block (URB) (e.g., due to device disconnect or ENOMEM), the completion callback is never executed. Currently, the driver ignores the return value of rtw_usb_write_port() in rtw_usb_write_data() and rtw_usb_tx_agg_skb(). Because these functions rely on the completion callback to free the socket buffers (skbs) and the transaction control block (txcb), a submission failure results in: 1. A memory leak of the allocated skb in rtw_usb_write_data(). 2. A memory leak of the txcb structure and all aggregated skbs in rtw_usb_tx_agg_skb(). Fix this by checking the return value of rtw_usb_write_port(). If it fails, explicitly free the skb in rtw_usb_write_data(), and properly purge the tx_ack_queue and free the txcb in rtw_usb_tx_agg_skb(). The issue was discovered in practice during device disconnect/reconnect scenarios and memory pressure conditions. Tested by verifying normal TX operation continues after the fix without regressions.
Severity
No CVSS data available.
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: a82dfd33d1237f6c0fb8a7077022189d1fc7ec98 , < 2b2060c2075a72bc2de43ce5e1b9347d6c5e27bb (git)
Affected: a82dfd33d1237f6c0fb8a7077022189d1fc7ec98 , < 53fed4061a09755de99c89fdc7fae5b794da455f (git)
Affected: a82dfd33d1237f6c0fb8a7077022189d1fc7ec98 , < 200d58c851b8f63f77a05570072dd20f79bc3681 (git)
Affected: a82dfd33d1237f6c0fb8a7077022189d1fc7ec98 , < 8206d173d18ef5a077423119f4e9a93cb3a6f4eb (git)
Affected: a82dfd33d1237f6c0fb8a7077022189d1fc7ec98 , < 6b964941bbfe6e0f18b1a5e008486dbb62df440a (git)
Create a notification for this product.
Linux Linux Affected: 6.2
Unaffected: 0 , < 6.2 (semver)
Unaffected: 6.6.144 , ≤ 6.6.* (semver)
Unaffected: 6.12.95 , ≤ 6.12.* (semver)
Unaffected: 6.18.38 , ≤ 6.18.* (semver)
Unaffected: 7.1.3 , ≤ 7.1.* (semver)
Unaffected: 7.2-rc1 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wireless/realtek/rtw88/usb.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "2b2060c2075a72bc2de43ce5e1b9347d6c5e27bb",
              "status": "affected",
              "version": "a82dfd33d1237f6c0fb8a7077022189d1fc7ec98",
              "versionType": "git"
            },
            {
              "lessThan": "53fed4061a09755de99c89fdc7fae5b794da455f",
              "status": "affected",
              "version": "a82dfd33d1237f6c0fb8a7077022189d1fc7ec98",
              "versionType": "git"
            },
            {
              "lessThan": "200d58c851b8f63f77a05570072dd20f79bc3681",
              "status": "affected",
              "version": "a82dfd33d1237f6c0fb8a7077022189d1fc7ec98",
              "versionType": "git"
            },
            {
              "lessThan": "8206d173d18ef5a077423119f4e9a93cb3a6f4eb",
              "status": "affected",
              "version": "a82dfd33d1237f6c0fb8a7077022189d1fc7ec98",
              "versionType": "git"
            },
            {
              "lessThan": "6b964941bbfe6e0f18b1a5e008486dbb62df440a",
              "status": "affected",
              "version": "a82dfd33d1237f6c0fb8a7077022189d1fc7ec98",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wireless/realtek/rtw88/usb.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.2"
            },
            {
              "lessThan": "6.2",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.144",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.95",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.38",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.144",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.95",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.38",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.3",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2-rc1",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: rtw88: usb: fix memory leaks on USB write failures\n\nWhen rtw_usb_write_port() fails to submit a USB Request Block (URB)\n(e.g., due to device disconnect or ENOMEM), the completion callback is\nnever executed.\n\nCurrently, the driver ignores the return value of rtw_usb_write_port()\nin rtw_usb_write_data() and rtw_usb_tx_agg_skb(). Because these\nfunctions rely on the completion callback to free the socket buffers\n(skbs) and the transaction control block (txcb), a submission failure\nresults in:\n1. A memory leak of the allocated skb in rtw_usb_write_data().\n2. A memory leak of the txcb structure and all aggregated skbs in\n   rtw_usb_tx_agg_skb().\n\nFix this by checking the return value of rtw_usb_write_port(). If it\nfails, explicitly free the skb in rtw_usb_write_data(), and properly\npurge the tx_ack_queue and free the txcb in rtw_usb_tx_agg_skb().\n\nThe issue was discovered in practice during device disconnect/reconnect\nscenarios and memory pressure conditions. Tested by verifying normal TX\noperation continues after the fix without regressions."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-19T12:02:18.751Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/2b2060c2075a72bc2de43ce5e1b9347d6c5e27bb"
        },
        {
          "url": "https://git.kernel.org/stable/c/53fed4061a09755de99c89fdc7fae5b794da455f"
        },
        {
          "url": "https://git.kernel.org/stable/c/200d58c851b8f63f77a05570072dd20f79bc3681"
        },
        {
          "url": "https://git.kernel.org/stable/c/8206d173d18ef5a077423119f4e9a93cb3a6f4eb"
        },
        {
          "url": "https://git.kernel.org/stable/c/6b964941bbfe6e0f18b1a5e008486dbb62df440a"
        }
      ],
      "title": "wifi: rtw88: usb: fix memory leaks on USB write failures",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-63821",
    "datePublished": "2026-07-19T12:02:18.751Z",
    "dateReserved": "2026-07-19T07:54:57.014Z",
    "dateUpdated": "2026-07-19T12:02:18.751Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-63821",
      "date": "2026-07-21",
      "epss": "0.00157",
      "percentile": "0.05273"
    },
    "microsoft_vex": {
      "current_release_date": "2026-07-20T14:45:05.000Z",
      "cve": "CVE-2026-63821",
      "id": "msrc_CVE-2026-63821",
      "initial_release_date": "2026-07-20T01:06:05.000Z",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "wifi: rtw88: usb: fix memory leaks on USB write failures",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-63821.json",
      "version": "2"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-63821\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-07-19T12:16:55.203\",\"lastModified\":\"2026-07-19T12:16:55.203\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nwifi: rtw88: usb: fix memory leaks on USB write failures\\n\\nWhen rtw_usb_write_port() fails to submit a USB Request Block (URB)\\n(e.g., due to device disconnect or ENOMEM), the completion callback is\\nnever executed.\\n\\nCurrently, the driver ignores the return value of rtw_usb_write_port()\\nin rtw_usb_write_data() and rtw_usb_tx_agg_skb(). Because these\\nfunctions rely on the completion callback to free the socket buffers\\n(skbs) and the transaction control block (txcb), a submission failure\\nresults in:\\n1. A memory leak of the allocated skb in rtw_usb_write_data().\\n2. A memory leak of the txcb structure and all aggregated skbs in\\n   rtw_usb_tx_agg_skb().\\n\\nFix this by checking the return value of rtw_usb_write_port(). If it\\nfails, explicitly free the skb in rtw_usb_write_data(), and properly\\npurge the tx_ack_queue and free the txcb in rtw_usb_tx_agg_skb().\\n\\nThe issue was discovered in practice during device disconnect/reconnect\\nscenarios and memory pressure conditions. Tested by verifying normal TX\\noperation continues after the fix without regressions.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/net/wireless/realtek/rtw88/usb.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"a82dfd33d1237f6c0fb8a7077022189d1fc7ec98\",\"lessThan\":\"2b2060c2075a72bc2de43ce5e1b9347d6c5e27bb\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"a82dfd33d1237f6c0fb8a7077022189d1fc7ec98\",\"lessThan\":\"53fed4061a09755de99c89fdc7fae5b794da455f\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"a82dfd33d1237f6c0fb8a7077022189d1fc7ec98\",\"lessThan\":\"200d58c851b8f63f77a05570072dd20f79bc3681\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"a82dfd33d1237f6c0fb8a7077022189d1fc7ec98\",\"lessThan\":\"8206d173d18ef5a077423119f4e9a93cb3a6f4eb\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"a82dfd33d1237f6c0fb8a7077022189d1fc7ec98\",\"lessThan\":\"6b964941bbfe6e0f18b1a5e008486dbb62df440a\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/net/wireless/realtek/rtw88/usb.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.2\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.2\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.144\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.95\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.38\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1.3\",\"lessThanOrEqual\":\"7.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2-rc1\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/200d58c851b8f63f77a05570072dd20f79bc3681\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/2b2060c2075a72bc2de43ce5e1b9347d6c5e27bb\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/53fed4061a09755de99c89fdc7fae5b794da455f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/6b964941bbfe6e0f18b1a5e008486dbb62df440a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/8206d173d18ef5a077423119f4e9a93cb3a6f4eb\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "current_release_date": "2026-07-21T08:02:24+00:00",
      "cve": "CVE-2026-63821",
      "id": "CVE-2026-63821",
      "initial_release_date": "2026-07-19T00:00:00+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: wifi: rtw88: usb: fix memory leaks on USB write failures",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-63821.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.