Skip to main content

Linux Kernel CVE-2026-53258

| EUVDEUVD-2026-39209 MEDIUM
Memory Leak (CWE-401)
2026-06-25 416baaa9-dc9f-4396-8d5f-8c081fb06d67 GHSA-pw6x-273j-mp83
Information Disclosure Linux
5.5
CVSS 3.1 · NVD
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Obtain local low-privilege access
  2. Delivery
    Invoke wpa_supplicant 6 GHz scan via nl80211
  3. Exploit
    Trigger cfg80211_scan() failure mid-path
  4. Execution
    Leak 512-byte rdev->int_scan_req allocation
  5. Persist
    Repeat scan attempts to accumulate leaks
  6. Impact
    Exhaust kernel memory on constrained device

Vulnerability Assessment

Weakness
CWE
CWE-401
ASVS 5.0
V15 - Secure Coding and Architecture Resource cleanup, leak prevention
Exploitation Conditions

Exploitation requires local access with low privileges (CVSS PR:L) on a Linux host running an affected kernel version with a wireless adapter capable of 6 GHz (WiFi 6E or WiFi 7) scanning. The leak is triggered only when cfg80211_scan() is invoked for a split 6 GHz scan and that scan fails specifically at the point where rdev->scan_req is not yet set, causing ___cfg80211_scan_done() to return without freeing rdev->int_scan_req. Factors limiting exploitation: the system must have a 6 GHz-capable wireless NIC, the specific scan failure condition must be repeatedly triggered (typically via wpa_supplicant), the memory impact per event is only 512 bytes making single-trigger impact negligible, and remote exploitation is not possible (AV:L). Systems without 6 GHz-capable wireless hardware are not affected by this code path.
Impact

CVSS 5.5 Medium with AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H accurately characterizes a locally triggerable, low-complexity kernel memory leak with no confidentiality or integrity impact. The EPSS score of 0.16% (6th percentile) is consistent with this profile: the bug requires local access and repeated triggering of a specific failure condition, making opportunistic remote exploitation impossible. The vulnerability is not in CISA KEV and no POC has been identified, confirming this is not currently being weaponized. Real-world risk is primarily operational on memory-constrained systems (embedded access points, IoT, lightweight wpa_supplicant-driven devices) where repeated 6 GHz scan failures could slowly accumulate leaked 512-byte kernel objects and degrade availability. On general-purpose servers or desktops, the impact would be negligible absent an unusual workload. The ENISA tag 'Information Disclosure' is inconsistent with the CVSS C:N rating and the description - no confidentiality impact is substantiated; treat that tag as a mis-categorization.
Exploit ScenarioDerived

A local unprivileged process - for example, wpa_supplicant running as a system service - repeatedly initiates 6 GHz WiFi scans on a host equipped with a WiFi 6E-capable adapter; each scan that fails mid-path in cfg80211_scan() leaks a 512-byte kernel heap object. On a memory-constrained device such as an embedded wireless router or IoT gateway, sustained accumulation of these unreferenced kernel objects degrades available memory, eventually causing allocation failures or system instability. No public proof-of-concept exploit exists.
This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).
Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jul 08, 2026

Memory leak in the Linux kernel wifi cfg80211 subsystem allows a local low-privileged user to cause gradual kernel memory exhaustion by repeatedly triggering failed 6 GHz split scans. The leaked object is a 512-byte allocation in rdev->int_scan_req that escapes the cleanup path in ___cfg80211_scan_done() because rdev->scan_req is NULL at freeing time, causing an early return. No public exploit has been identified; EPSS of 0.16% (6th percentile) reflects very low real-world exploitation probability, and this vulnerability is not listed in CISA KEV.

RemediationAI

The primary fix is to upgrade the Linux kernel to a patched stable release: 6.18.36 or later in the 6.18 series, 7.0.13 or later in the 7.0 series, or Linux 7.1 (mainline). Patch commits are published at https://git.kernel.org/stable/c/fb8db813eba2e56ee001c9fb5c2ce2cb78c42642 (6.18.x), https://git.kernel.org/stable/c/e8694f7cc29287e843648d1075177b9a2000d957 (7.0.x), and https://git.kernel.org/stable/c/a24134ddc18b4d440714365637d440b7121447b9 (7.1/mainline). If an immediate kernel upgrade is not feasible, a targeted compensating control is to disable 6 GHz band scanning in wpa_supplicant configuration (via freq_list or band exclusion directives), which prevents the scan codepath from being entered; the trade-off is loss of WiFi 6E and WiFi 7 network discovery. Given that exploitation requires local access and repeated triggering, organizations should prioritize this fix during their normal kernel patching cadence rather than as an emergency response, except on memory-constrained embedded or real-time systems.

Affected VersionsENISA

Linux patch: 7.0.13
Linux c8cb5b854b40f2ce52ccd032fa19750f4181d5fc <e8694f7cc29287e843648d1075177b9a2000d957
Linux patch: 7.1
Linux 5.10
Linux patch: 6.18.36
Linux c8cb5b854b40f2ce52ccd032fa19750f4181d5fc <a24134ddc18b4d440714365637d440b7121447b9
Linux c8cb5b854b40f2ce52ccd032fa19750f4181d5fc <fb8db813eba2e56ee001c9fb5c2ce2cb78c42642
Linux patch: 0

Affected Packages

euvd linux no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The flaw resides in cfg80211_scan() within the Linux kernel's wireless configuration subsystem (cfg80211), which mediates between userspace Wi-Fi daemons (primarily wpa_supplicant via nl80211/generic netlink) and wireless hardware drivers. When a split 6 GHz scan is attempted and fails mid-path, a 512-byte kernel heap allocation for rdev->int_scan_req is made but never freed. The intended cleanup path is ___cfg80211_scan_done(), but that function exits early because rdev->scan_req is NULL at the point of failure, leaving rdev->int_scan_req unreferenced and leaked. CWE-401 (Missing Release of Memory After Effective Lifetime) describes this class precisely: the allocation outlives the codepath responsible for freeing it. The bug was discovered by the Linux Verification Center (linuxtesting.org) using kmemleak, with the backtrace anchored at cfg80211_scan+0x133/0x730. Affected CPE: cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*.

Know when the next one hits your stack

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI 5.5 MEDIUM

Local trigger via low-privilege wpa_supplicant call; memory leak causes availability impact only, with no confidentiality or integrity consequence.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE MEDIUM
Red Hat 5.5 LOW

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

3
CVSS changed
Jul 08, 2026 - 16:52 NVD
5.5 (MEDIUM)
CVE Published
Jun 25, 2026 - 09:16 nvd
MEDIUM 5.5
CVE Published
Jun 25, 2026 - 09:16 cve.org
UNKNOWN (no severity yet)

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

wifi: fix leak if split 6 GHz scanning fails

rdev->int_scan_req is leaked if cfg80211_scan() fails. Note that it's supposed to be released at ___cfg80211_scan_done() but this doesn't happen as rdev->scan_req is NULL at that point, too, leading to the early return from the freeing function.

unreferenced object 0xffff8881161d0800 (size 512): comm "wpa_supplicant", pid 379, jiffies 4294749765 hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00 00 00 00 00 00 00 00 f0 81 13 16 81 88 ff ff ................ backtrace (crc c867fdb6): kmemleak_alloc+0x89/0x90 __kmalloc_noprof+0x2fd/0x410 cfg80211_scan+0x133/0x730 nl80211_trigger_scan+0xc69/0x1cc0 genl_family_rcv_msg_doit+0x204/0x2f0 genl_rcv_msg+0x431/0x6b0 netlink_rcv_skb+0x143/0x3f0 genl_rcv+0x27/0x40 netlink_unicast+0x4f6/0x820 netlink_sendmsg+0x797/0xce0 __sock_sendmsg+0xc4/0x160 ____sys_sendmsg+0x5e4/0x890 ___sys_sendmsg+0xf8/0x180 __sys_sendmsg+0x136/0x1e0 __x64_sys_sendmsg+0x76/0xc0 x64_sys_call+0x13f0/0x17d0

Found by Linux Verification Center (linuxtesting.org).

Threat Intelligence Overview

EPSS Score
0.2%
Top 94% exploitable
Prevalence
Ubiquitous
Linux kernel underlies most servers, cloud, embedded, and mobile infrastructure
Data Quality
6 sources
Confidence: High
EUVD NVD CVE.org EPSS MSRC Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity MEDIUM
CISA KEV No
Public POC No
EPSS 0.2%
Patch available Yes
Active threat No
Deciding rule
MEDIUM severity (CVSS 4.0-6.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation· derived
None
System Exposure· derived
Small
Automatable· derived
No
Human Impact· derived
High

Priority Score

28
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +28
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

Same weakness CWE-401 – Memory Leak

View all
CVE-2020-13934 HIGH
7.5
CVE-2016-4232 HIGH POC
7.5
CVE-2025-25469 HIGH POC
8.8
CVE-2024-25450 HIGH POC
8.8
CVE-2023-33718 HIGH POC
8.8
CVE-2019-6128 HIGH POC
8.8
CVE-2026-67183 HIGH POC
8.7
CVE-2023-34451 HIGH POC
8.2

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2025-68613 HIGH POC
8.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
Container suse/sl-micro/6.0/base-os-container:2.1.3-7.177 Container suse/sl-micro/6.1/base-os-container:2.2.1-5.155 Affected
Container suse/sl-micro/6.0/rt-os-container:2.1.3-7.206 Container suse/sl-micro/6.1/rt-os-container:2.2.1-5.152 Affected
Image SLES15-SP7-Azure-3P Image SLES15-SP7-Azure-Basic Image SLES15-SP7-Azure-Standard Image SLES15-SP7-HPC-Azure Affected
Image SLES15-SP7-BYOS-Azure Image SLES15-SP7-BYOS-GCE Image SLES15-SP7-CHOST-BYOS-Aliyun Image SLES15-SP7-CHOST-BYOS-Azure Image SLES15-SP7-CHOST-BYOS-EC2 Image SLES15-SP7-CHOST-BYOS-GCE Image SLES15-SP7-CHOST-BYOS-GDC Image SLES15-SP7-CHOST-BYOS-SAP-CCloud Image SLES15-SP7-EC2 Image SLES15-SP7-EC2-ECS-HVM Image SLES15-SP7-GCE Image SLES15-SP7-HPC-BYOS-Azure Image SLES15-SP7-HPC-BYOS-EC2 Image SLES15-SP7-HPC-BYOS-GCE Image SLES15-SP7-Hardened-BYOS-Azure Image SLES15-SP7-Hardened-BYOS-EC2 Image SLES15-SP7-Hardened-BYOS-GCE Image SLES15-SP7-SAPCAL-Azure Image SLES15-SP7-SAPCAL-EC2 Image SLES15-SP7-SAPCAL-GCE Affected
Image SLES15-SP7-SAP-Azure Image SLES15-SP7-SAP-Azure-3P Image SLES15-SP7-SAP-BYOS-Azure Image SLES15-SP7-SAP-BYOS-EC2 Image SLES15-SP7-SAP-BYOS-GCE Image SLES15-SP7-SAP-EC2 Image SLES15-SP7-SAP-GCE Image SLES15-SP7-SAP-Hardened-Azure Image SLES15-SP7-SAP-Hardened-BYOS-Azure Image SLES15-SP7-SAP-Hardened-BYOS-EC2 Image SLES15-SP7-SAP-Hardened-BYOS-GCE Image SLES15-SP7-SAP-Hardened-GCE Affected

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-53258 ADVISORY https://ubuntu.com/security/notices/USN-8726-1 ADVISORY https://ubuntu.com/security/notices/USN-8727-1 ADVISORY https://vuldb.com/vuln/373820 ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:22742/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:22769/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:3130/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:3166/ REF https://git.kernel.org/stable/c/87484866cae9130b97c2b356eeaea4f47b292f75 REF https://git.kernel.org/stable/c/a24134ddc18b4d440714365637d440b7121447b9 REF https://git.kernel.org/stable/c/c3d30daf03130cf35c0e70185719ce16fc3ea6c4 REF https://git.kernel.org/stable/c/df44397bbd8f3a38115c9590b686787e4aaf6327 REF https://git.kernel.org/stable/c/e8694f7cc29287e843648d1075177b9a2000d957 REF https://git.kernel.org/stable/c/fb8db813eba2e56ee001c9fb5c2ce2cb78c42642

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy