Skip to main content

Linux Kernel CVE-2026-31672

| EUVDEUVD-2026-25565 MEDIUM
Memory Leak (CWE-401)
2026-04-24 Linux GHSA-jj24-8c57-hf8x
Information Disclosure Linux
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
5.5 MEDIUM

Local-only attack via driver unbind, low privileges to trigger, no network exposure, purely availability impact from memory leak.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative
Red Hat
5.5 MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

6
Analysis Generated
Jul 24, 2026 - 02:23 vuln.today
CVSS changed
Apr 27, 2026 - 20:22 NVD
5.5 (MEDIUM)
Patch released
Apr 27, 2026 - 20:11 nvd
Patch available
Patch available
Apr 24, 2026 - 16:16 EUVD
EUVD ID Assigned
Apr 24, 2026 - 15:00 euvd
EUVD-2026-25565
CVE Published
Apr 24, 2026 - 14:45 nvd
MEDIUM 5.5

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

wifi: rt2x00usb: fix devres lifetime

USB drivers bind to USB interfaces and any device managed resources should have their lifetime tied to the interface rather than parent USB device. This avoids issues like memory leaks when drivers are unbound without their devices being physically disconnected (e.g. on probe deferral or configuration changes).

Fix the USB anchor lifetime so that it is released on driver unbind.

AnalysisAI

Memory leak in the Linux kernel's rt2x00usb WiFi driver allows a local low-privileged user to exhaust kernel memory on systems equipped with Ralink RT2x00-based USB WiFi adapters. The flaw - present since kernel 4.7 - results from USB anchor device-managed resources being incorrectly scoped to the parent USB device rather than the USB interface, so resources are not released when the driver unbinds without a physical device disconnection. No active exploitation is confirmed (not in CISA KEV) and EPSS stands at 0.02% (7th percentile), marking this as a low-urgency stability fix rather than an emergency security response.

Technical ContextAI

The rt2x00usb driver manages USB-based WiFi adapters built on the Ralink RT2x00 chipset family. Linux's devres (device-managed resources) framework ties resource cleanup to a specific device object's lifecycle. The root cause per CWE-401 (Missing Release of Memory after Effective Lifetime) is that USB anchors - kernel structures used to track in-flight USB URBs - were allocated against the parent USB device (udev) rather than the USB interface (intf). When a driver unbinds from its USB interface without physical disconnection (scenarios include probe deferral, configuration changes, or manual rebind), the interface's devres cleanup fires but does not free anchors attached to the parent device. Those anchors leak until the physical device is disconnected. The fix scopes the USB anchor lifetime to the USB interface, consistent with how USB drivers are expected to interact with devres. Affected CPE: cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:*.

RemediationAI

The primary fix is upgrading to a patched kernel version: 5.10.253, 5.15.203, 6.1.169, 6.6.135, 6.12.82, 6.18.23, 6.19.13, or 7.0, applied via standard distribution update mechanisms (apt, dnf, zypper). Ubuntu users should apply USN-8567-1; Red Hat and SUSE users should monitor their vendor advisories for kernel package updates. If immediate kernel update is not feasible and the system hosts RT2x00 USB WiFi hardware, a practical compensating control is to ensure physical disconnection of the USB adapter before any driver unbind operation (e.g., before driver reload or configuration changes), which avoids triggering the leaking code path - however, this is operationally impractical for automated systems. Systems that do not use RT2x00-based USB WiFi adapters are not affected and require no action. Stable-tree commits are available at https://git.kernel.org/stable/c/ for the respective fix hashes listed in EUVD.

Same weakness CWE-401 – Memory Leak

View all
CVE-2020-13934 HIGH
7.5
CVE-2016-4232 HIGH POC
7.5
CVE-2024-25450 HIGH POC
8.8
CVE-2023-33718 HIGH POC
8.8
CVE-2019-6128 HIGH POC
8.8
CVE-2026-67183 HIGH POC
8.7
CVE-2023-34451 HIGH POC
8.2
CVE-2023-41484 HIGH POC
8.1

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed

Share

CVE-2026-31672 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy