Skip to main content

Linux Kernel CVE-2026-31604

| EUVDEUVD-2026-25497 MEDIUM
Memory Leak (CWE-401)
2026-04-24 Linux GHSA-jcj3-vp6r-4j69
Information Disclosure Linux
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
5.5 MEDIUM

Local vector because probe is triggered by USB device attachment; PR:L as standard shell access is needed; A:H for kernel resource exhaustion potential; C:N and I:N as no data exposure or write primitive exists.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative
Red Hat
5.5 MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

6
Analysis Generated
Jul 24, 2026 - 02:55 vuln.today
CVSS changed
Apr 29, 2026 - 19:22 NVD
5.5 (MEDIUM)
Patch released
Apr 29, 2026 - 19:21 nvd
Patch available
Patch available
Apr 24, 2026 - 16:16 EUVD
EUVD ID Assigned
Apr 24, 2026 - 15:00 euvd
EUVD-2026-25497
CVE Published
Apr 24, 2026 - 14:42 nvd
MEDIUM 5.5

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

wifi: rtw88: fix device leak on probe failure

Driver core holds a reference to the USB interface and its parent USB device while the interface is bound to a driver and there is no need to take additional references unless the structures are needed after disconnect.

This driver takes a reference to the USB device during probe but does not to release it on all probe errors (e.g. when descriptor parsing fails).

Drop the redundant device reference to fix the leak, reduce cargo culting, make it easier to spot drivers where an extra reference is needed, and reduce the risk of further memory leaks.

AnalysisAI

Resource leak in the Linux kernel rtw88 USB WiFi driver allows a local attacker with low privileges to cause system availability degradation by triggering repeated probe failures that leave unreleased USB device references. The driver increments the USB device reference count during probe but fails to decrement it on all error exit paths - specifically when descriptor parsing fails - resulting in CWE-401 reference leaks that accumulate over time. No public exploit exists and EPSS is at the 6th percentile (0.02%), indicating negligible exploitation probability; the real-world impact is constrained to systems with Realtek rtw88 USB WiFi adapters.

Technical ContextAI

The rtw88 driver is a Linux kernel subsystem (under drivers/net/wireless/realtek/rtw88/) that supports Realtek RTW88-series USB wireless adapters. During USB driver probe, the driver calls get_device() to increment the USB device reference count, which is appropriate only when the reference is needed past the disconnect callback. When probe fails at intermediate stages - for example during USB descriptor parsing - the corresponding put_device() call was absent, leaving a dangling reference. CWE-401 (Missing Release of Memory after Effective Lifetime) governs this root cause class: resources are allocated and tracked by the kernel reference-counting subsystem but never freed on certain code paths. The CPE cpe:2.3:a:linux:linux confirms the Linux kernel itself as the affected software across all architectures where rtw88 USB devices are supported.

RemediationAI

Update the Linux kernel to a patched stable release: 6.12.83 or later for the 6.12 series, 6.18.24 or later for the 6.18 series, 6.19.14 or later for the 6.19 series, or 7.0.1 or later for the 7.0 series. The upstream fixes are available at https://git.kernel.org/stable/c/a4f4371d194dfa5473cc961f86194084b1b13a69 (7.0.1), https://git.kernel.org/stable/c/89a9c1bc7d797120bcc290864e0cb10a440a677f (6.18.24), https://git.kernel.org/stable/c/af7307e96dad00bcc2675dac650d8558a52f2c6f (6.19.14), and https://git.kernel.org/stable/c/25a827b7e1d5747a255bdc757f1d3e9e1e8a4e2a (6.12.83). Ubuntu users should apply USN-8488-1. As a workaround on systems where rtw88 USB WiFi is not required, blacklisting the rtw88usb kernel module (echo 'blacklist rtw88usb' >> /etc/modprobe.d/blacklist.conf) prevents the driver from loading entirely, eliminating the attack surface at the cost of losing USB WiFi functionality for affected Realtek adapters.

Same weakness CWE-401 – Memory Leak

View all
CVE-2020-13934 HIGH
7.5
CVE-2016-4232 HIGH POC
7.5
CVE-2024-25450 HIGH POC
8.8
CVE-2023-33718 HIGH POC
8.8
CVE-2019-6128 HIGH POC
8.8
CVE-2026-67183 HIGH POC
8.7
CVE-2023-34451 HIGH POC
8.2
CVE-2023-41484 HIGH POC
8.1

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed

Share

CVE-2026-31604 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy