Skip to main content

Linux Kernel EUVDEUVD-2025-209673

| CVE-2025-71273 MEDIUM
Memory Leak (CWE-401)
2026-05-06 Linux GHSA-gx72-jpcx-hm2h
Information Disclosure Linux
5.5
CVSS 3.1 · NVD
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Gain local shell access
  2. Delivery
    Load or reload rtw88 driver
  3. Exploit
    Trigger hardware registration cycles
  4. Execution
    Exhaust kernel memory
  5. Persist
    Trigger OOM killer
  6. Impact
    Deny service

Vulnerability Assessment

Weakness
CWE
CWE-401
ASVS 5.0
V15 - Secure Coding and Architecture Resource cleanup, leak prevention
Exploitation Conditions

Exploitation requires local authentication (regular user or higher privilege level) on systems with rtw88 driver-compatible WiFi hardware (Realtek RTL8821CE or similar chipsets using rtl8821ce driver). The rtw88 driver must be loaded and hardware initialization must be attempted or retriggered. The vulnerability manifests only when rtw_register_hw() encounters an error condition that bypasses normal memory cleanup. Systems without Realtek WiFi hardware, or those using alternative drivers (e.g., upstream rtl8xxxu), are unaffected. Memory leak exploitation requires either repeated trigger cycles to accumulate freed memory or a specific kernel configuration that prevents automatic memory reclamation.
Impact

CVSS 5.5 (Local, Low Complexity, Requires Privilege) indicates moderate local DoS risk, but real-world impact is constrained by multiple factors. EPSS 0.02% percentile ranks this in the lowest exploitation tier, reflecting that memory leaks require either repeated trigger conditions or specific kernel configurations to manifest as observable failures. The vulnerability requires local authentication (PR:L) and cannot be triggered remotely. Attack complexity is low once access is obtained, but the actual trigger-hardware registration failure-depends on timing and platform-specific WiFi enumeration. No active exploitation (KEV status not indicated) or POC is referenced. The denial of service impact is gradual (memory exhaustion over time) rather than immediate, reducing tactical urgency. This is a maintenance fix addressing kernel hygiene rather than a critical security breach; organizations should treat it as part of routine patching rather than emergency response.
Exploit ScenarioDerived

A local user with shell access on a system with rtl8821ce WiFi hardware repeatedly triggers hardware registration or driver reload cycles (via modprobe/rmmod or interface down/up). Each failed registration leaks kernel memory from the unsupported bands allocation. Over hours or days of repeated cycles, kernel memory exhaustion forces the OOM killer to terminate critical services (sshd, init, etc.), rendering the system unresponsive or rebooting unexpectedly.
This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – May 13, 2026

Memory leak in rtw88 WiFi driver allows local authenticated attackers to cause denial of service via supported band allocation failure. The rtw_set_supported_band() function in the rtl8821ce WiFi driver failed to free allocated memory in error paths during hardware registration, enabling a local privilege escalation attack that exhausts kernel memory. EPSS exploitation probability is very low (0.02%), indicating this is a hardening fix rather than a critical vulnerability.

RemediationAI

Upgrade to Linux kernel version 6.12.75, 6.18.16, 6.19.6, or 7.0 (or newer) which contain the devm_kmemdup() conversion fix. For systems unable to upgrade immediately, disable the rtw88 driver module (rmmod rtw88) if an alternative WiFi driver is available, though this sacrifices wireless functionality on affected hardware. Alternatively, configure kernel memory limits via cgroup v2 memory.max to prevent kernel OOM killer from impacting critical services during prolonged operation. The canonical fix is available at git.kernel.org/stable/c/9b5418070ee8468fac9e8bf641c83d46b85bff30 for mainline integration. No workarounds mitigate the leak without code changes; only kernel upgrade eliminates the underlying memory management defect.

Affected VersionsENISA

Linux patch: 6.19.6
Linux patch: 7.0
Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <2ba12401cc1f2d970fa2e7d5b15abde3f5abd40d
Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <9b5418070ee8468fac9e8bf641c83d46b85bff30
Linux patch: 6.12.75
Linux patch: 6.18.16
Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <ad9b80ee310ed734482a2e5da874b67f88ac0ef8
Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <1bd90e0a99fdc8dc5deb3c92bf865e4496b4b311

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The rtw88 WiFi driver is part of the Linux kernel's 802.11 wireless subsystem. The vulnerability resides in rtw_register_hw(), which calls rtw_set_supported_band() to allocate memory for supported IEEE 802.11 bands (2.4 GHz, 5 GHz, 6 GHz). The original code used direct kmalloc() allocations without devm (device-managed) wrappers, meaning memory was not automatically freed if hardware registration failed. The fix converts to devm_kmemdup() which ties memory lifetime to the device object, ensuring cleanup on error or driver unload. CWE-401 (Missing Release of Memory after Effective Lifetime) classifies this as a resource management failure where allocated memory persists beyond its intended scope.

Know when the next one hits your stack

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
SUSE MEDIUM
Red Hat 5.5 MEDIUM

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

3
CVSS changed
May 12, 2026 - 21:37 NVD
5.5 (MEDIUM)
Patch available
May 06, 2026 - 13:02 EUVD
CVE Published
May 06, 2026 - 11:27 nvd
MEDIUM 5.5

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

wifi: rtw88: Use devm_kmemdup() in rtw_set_supported_band()

Simplify the code by using device managed memory allocations.

This also fixes a memory leak in rtw_register_hw(). The supported bands were not freed in the error path.

Copied from commit 145df52a8671 ("wifi: rtw89: Convert rtw89_core_set_supported_band to use devm_*").

Threat Intelligence Overview

EPSS Score
0.0%
Top 95% exploitable
Data Quality
6 sources
Confidence: High
EUVD NVD CVE.org EPSS MSRC Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity MEDIUM
CISA KEV No
Public POC No
EPSS 0.0%
Patch available Yes
Active threat No
Deciding rule
MEDIUM severity (CVSS 4.0-6.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Defer
Exploitation· derived
None
System Exposure· derived
Small
Automatable· derived
No
Human Impact· derived
Medium

Priority Score

28
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +28
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

Same weakness CWE-401 – Memory Leak

View all
CVE-2020-13934 HIGH
7.5
CVE-2016-4232 HIGH POC
7.5
CVE-2025-25469 HIGH POC
8.8
CVE-2024-25450 HIGH POC
8.8
CVE-2023-33718 HIGH POC
8.8
CVE-2019-6128 HIGH POC
8.8
CVE-2026-67183 HIGH POC
8.7
CVE-2023-34451 HIGH POC
8.2

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2025-68613 HIGH POC
8.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2025-71273 ADVISORY https://ubuntu.com/security/notices/USN-8492-1 ADVISORY https://vuldb.com/vuln/361367 REF https://git.kernel.org/stable/c/1bd90e0a99fdc8dc5deb3c92bf865e4496b4b311 REF https://git.kernel.org/stable/c/2ba12401cc1f2d970fa2e7d5b15abde3f5abd40d REF https://git.kernel.org/stable/c/537723ada6d6655f0a2f48ab000fd9b0358bb442 REF https://git.kernel.org/stable/c/9b5418070ee8468fac9e8bf641c83d46b85bff30 REF https://git.kernel.org/stable/c/ad9b80ee310ed734482a2e5da874b67f88ac0ef8 REF https://git.kernel.org/stable/c/d57e31c8df7b8bb684c6b56854676972a8b7c8ed

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy