CVE-2026-53258: Linux Kernel WiFi Scanning Memory Leak (CWE-401)

Technical summary

CVE-2026-53258 is a use-after-free prevention failure classified as CWE-401 (Missing Release of Memory after Effective Lifetime). The vulnerability occurs in cfg80211_scan() within the Linux kernel's wireless configuration subsystem. When 6 GHz band scanning is split and cfg80211_scan() fails partway through execution, rdev->int_scan_req is allocated but the corresponding cleanup path in ___cfg80211_scan_done() returns early because it checks rdev->scan_req first. Since both pointers are NULL in the failure scenario, the allocated 512-byte structure remains unreleased. The kernel memory leak detector (kmemleak) identified the orphaned allocation with a full backtrace showing the allocation path through nl80211_trigger_scan() via netlink message handling. This is a kernel-mode memory leak accessible from unprivileged user context through the nl80211 interface.

Business impact

For enterprise environments, this vulnerability represents a denial-of-service vector through resource exhaustion. On systems where unprivileged users can trigger WiFi scans—common in shared desktop or server environments—attackers can repeatedly invoke the failing scan path to accumulate kernel memory leaks. Over time, this degrades system performance, increases swap pressure, and may eventually cause out-of-memory conditions that crash services or the kernel itself. Organizations relying on Linux-based network infrastructure, particularly those using WiFi-capable systems with multi-user access, face gradual degradation of availability. The impact is heightened in containerized or virtualized environments where kernel memory is a shared constraint.

Affected systems

All Linux kernel versions containing the vulnerable cfg80211 WiFi scanning code are affected. The vulnerability impacts any system running the Linux kernel with WiFi support enabled, including desktop distributions, servers with wireless adapters, embedded systems, and container hosts. Specific version boundaries require verification against vendor advisories and kernel git history, but the fix targets the split 6 GHz scanning logic introduced in recent kernel development. Systems with nl80211 support and user-accessible WiFi interfaces are directly vulnerable; the attack surface is any process able to send nl80211 netlink messages (typically unprivileged users on systems with WiFi capability).

Exploitability

The vulnerability is relatively straightforward to exploit but requires local access. An unprivileged local user with the ability to trigger WiFi scans (standard on most Linux desktops and many servers) can invoke the vulnerable code path repeatedly. No special privileges, authentication, or user interaction are required beyond the ability to send netlink messages through standard WiFi management interfaces. The repetitive nature of the leak makes exploitation practical: an attacker can write a simple script that triggers scan failures in a loop, gradually consuming kernel memory. The barrier to exploitation is low; the CVSS score of 5.5 reflects the local-only requirement and lack of confidentiality or integrity impact, but acknowledges the availability risk. This is not currently in CISA's Known Exploited Vulnerabilities catalog.

Remediation

The remediation involves modifying the cleanup logic in cfg80211_scan() and ___cfg80211_scan_done() to properly release rdev->int_scan_req even when rdev->scan_req is NULL. The fix ensures that both scan request structures are freed independently rather than relying on a single guard condition. This is a relatively surgical change to the wireless core code that should be low-risk to deploy. Kernel maintainers should have released a patch; verify the specific patched kernel version against the Linux kernel security advisories and your distribution's vendor advisory.

Patch guidance

Check your Linux distribution's security advisory for the patched kernel version addressing CVE-2026-53258. Ubuntu, Fedora, RHEL, Debian, and other major distributions will provide updated kernel packages. Apply the latest stable kernel update for your distribution. For enterprise deployments, validate the patch version against the vendor advisory before rolling out. If you maintain custom kernels, apply the upstream fix to your kernel source and rebuild. Test the patched kernel in a non-production environment first to ensure WiFi scanning functionality remains intact and that no regressions are introduced. Given the low severity score, this can typically be prioritized with regular patch management cycles, though systems with high user turnover or frequent WiFi scans should prioritize sooner.

Detection guidance

Monitor kernel logs (dmesg, journalctl) for kmemleak reports referencing cfg80211_scan or nl80211_trigger_scan. Systems with kmemleak enabled will report unreferenced memory allocations with backtraces. Analyze /sys/kernel/debug/kmemleak output for any leaks in the cfg80211 subsystem. Memory pressure and swap activity spikes coinciding with WiFi scanning activity may indicate exploitation. Host-based monitoring can track kernel memory usage over time; sustained growth without corresponding process memory growth suggests kernel leaks. On systems where unprivileged users have scan privileges, correlate scan frequency with memory degradation. Long-term, memory profiling of the kernel allocator will show 512-byte allocations in the cfg80211 code path persisting after failed scans.

Why prioritize this

Despite its MEDIUM severity rating, this vulnerability warrants attention because it enables resource exhaustion from low-privileged contexts. The leak is triggered through normal WiFi operations, making it passive and repeatable. While the immediate impact is availability rather than confidentiality or integrity, systems with multi-user access, shared hosting, or container environments face meaningful risk from cumulative memory exhaustion. This is especially relevant for embedded systems, IoT gateways, and edge servers where kernel memory is constrained. However, the requirement for local access and the indirect nature of the denial-of-service place it below critical vulnerabilities; standard patch management cycles are appropriate, though WiFi-intensive environments should prioritize sooner.

Risk score, explained

The CVSS 3.1 score of 5.5 (MEDIUM) reflects a local-only attack vector (AV:L) with low complexity (AC:L), low privilege requirements (PR:L), and no user interaction (UI:N). The scope is unchanged (S:U), and there is no impact to confidentiality (C:N) or integrity (I:N). The high availability impact (A:H) from resource exhaustion justifies the moderate score. The vulnerability does not cross privilege boundaries (no scope change) and requires initial local access, preventing remote exploitation. The lack of CISA KEV listing indicates no active exploitation has been reported in the wild as of the publication date, further supporting a measured but not emergency response.

Frequently asked questions