What is the CVSS score of EUVD-2026-38981?

EUVD-2026-38981 has a CVSS 3.1 base score of 5.5 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.2%.

Is there a patch available for EUVD-2026-38981?

Yes, a patch is available for EUVD-2026-38981. Update the affected software to the latest version immediately.

Linux Kernel EUVD-2026-38981

| CVE-2026-53113 MEDIUM

Memory Leak (CWE-401)

2026-06-24 Linux

GHSA-wf4x-cm6m-6wpw

Information Disclosure Linux

5.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

5.5 MEDIUM

Local access and low privileges required to interact with kernel WiFi driver; no confidentiality or integrity impact, only memory exhaustion availability effect.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

SUSE

MEDIUM

qualitative

Red Hat

5.5 LOW

qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 21:46 vuln.today

CVSS changed

Jul 23, 2026 - 21:38 NVD

5.5 (MEDIUM)

Patch available

Jun 24, 2026 - 18:02 EUVD

CVE Published

Jun 24, 2026 - 16:30 nvd

MEDIUM 5.5

CVE Published

Jun 24, 2026 - 16:30 cve.org

UNKNOWN (no severity yet)

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

wifi: ath11k: fix memory leaks in beacon template setup

The functions ath11k_mac_setup_bcn_tmpl_ema() and ath11k_mac_setup_bcn_tmpl_mbssid() allocate memory for beacon templates but fail to free it when parameter setup returns an error.

Since beacon templates must be released during normal execution, they must also be released in the error handling paths to prevent memory leaks.

Fix this by using unified exit paths with proper cleanup in the respective error paths.

Compile tested only. Issue found using a prototype static analysis tool and code review.

AnalysisAI

Memory leaks in the Linux kernel's ath11k Wi-Fi driver (Qualcomm 802.11ax/Wi-Fi 6) expose systems to local availability-only denial-of-service via kernel memory exhaustion. The affected functions ath11k_mac_setup_bcn_tmpl_ema() and ath11k_mac_setup_bcn_tmpl_mbssid() fail to release allocated beacon template memory when error conditions occur in parameter setup, causing incremental heap exhaustion. With EPSS at 0.16% (5th percentile), no public exploit, and no CISA KEV listing, this is a low-urgency fix discovered through static analysis - not active exploitation.

Technical ContextAI

CWE-401 (Missing Release of Memory after Effective Lifetime) applies here: the ath11k driver, which supports Qualcomm 802.11ax (Wi-Fi 6) chipsets in the Linux kernel, allocates kernel heap memory for MBSSID (Multiple BSSID) and EMA (Enhanced Multiple BSSID Advertisement) beacon templates. When a downstream parameter configuration step fails, the early-exit error paths bypass the normal cleanup logic, leaving those allocations unreleased. Over repeated error-triggering interactions with the driver, this produces a cumulative kernel memory leak. CPE data (cpe:2.3:a:linux:linux:*) confirms the affected component is the upstream Linux kernel itself, with the driver present on systems using Qualcomm Wi-Fi 6 hardware. The issue was identified via prototype static analysis tooling and code review - not runtime observation - meaning the practical trigger conditions in real deployments have not been independently characterized.

RemediationAI

Apply the upstream kernel fix commits 5d63aa38d5ca85206d9699ffdd616b58780dba07 and ff49eba595df500e4ddccc593088c8a4ab5f2c27 from the Linux stable tree (https://git.kernel.org/stable/c/5d63aa38d5ca85206d9699ffdd616b58780dba07 and https://git.kernel.org/stable/c/ff49eba595df500e4ddccc593088c8a4ab5f2c27). Ubuntu users should apply updates referenced in USN-8568-1 and USN-8566-1. For systems where immediate patching is not feasible and the ath11k driver is not required, unloading the module via 'modprobe -r ath11k' eliminates the attack surface entirely, with the trade-off of disabling Qualcomm Wi-Fi 6 hardware. No workaround is available that preserves ath11k functionality while eliminating the leak paths. Given the low EPSS and absence of active exploitation, standard scheduled patch cadence is appropriate.

Same weakness CWE-401 – Memory Leak

View all

CVE-2020-13934 HIGH

7.5

CVE-2016-4232 HIGH POC

7.5

CVE-2024-25450 HIGH POC

8.8

CVE-2023-33718 HIGH POC

8.8

CVE-2019-6128 HIGH POC

8.8

CVE-2026-67183 HIGH POC

8.7

CVE-2023-34451 HIGH POC

8.2

CVE-2023-41484 HIGH POC

8.1

Same technique Information Disclosure

View all

CVE-2019-2725 CRITICAL POC

9.8

CVE-2021-34523 CRITICAL POC

9.0

CVE-2013-2251 CRITICAL POC

9.8

CVE-2017-5638 CRITICAL POC

9.8

CVE-2025-24813 CRITICAL POC

9.8

CVE-2015-1701 HIGH POC

7.8

CVE-2017-0147 HIGH POC

7.5

CVE-2014-6324 HIGH POC

8.8

Vendor StatusVendor

SUSE

Severity: Moderate

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 16.0	Not-Affected

EUVD-2026-38981 vulnerability details – vuln.today

Back

Linux Kernel EUVD-2026-38981

Severity by source

CVSS VectorNVD

Lifecycle Timeline

DescriptionNVD

AnalysisAI

Technical ContextAI

RemediationAI

Same weakness CWE-401 – Memory Leak

Same technique Information Disclosure

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code