CVE-2026-53113

wifi: ath11k: fix memory leaks in beacon template setup

Published Jun 24, 2026 CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Description

In the Linux kernel, the following vulnerability has been resolved:

wifi: ath11k: fix memory leaks in beacon template setup

The functions ath11k_mac_setup_bcn_tmpl_ema() and
ath11k_mac_setup_bcn_tmpl_mbssid() allocate memory for beacon templates
but fail to free it when parameter setup returns an error.

Since beacon templates must be released during normal execution, they
must also be released in the error handling paths to prevent memory
leaks.

Fix this by using unified exit paths with proper cleanup in the respective
error paths.

Compile tested only. Issue found using a prototype static analysis tool
and code review.

Analysis

Technical impact

The ath11k Wi‑Fi driver in the Linux kernel contains a defect where memory allocated for beacon templates within ath11k_mac_setup_bcn_tmpl_ema() and ath11k_mac_setup_bcn_tmpl_mbssid() is not released when setup fails. This oversight causes a memory leak that can gradually exhaust kernel heap space, potentially degrading system performance or triggering out‑of‑memory conditions.

Affected Systems

The flaw resides in the ath11k driver component of the Linux kernel. Any system running a kernel version that includes the buggy beacon‑template logic is susceptible, including older mainline or custom builds that have not applied the recent patch commit. The CVE references a patch in the upstream kernel sources but no specific kernel version was listed in the advisory.

Risk and Exploitability

EPSS indicates that exploitation is unlikely, with a score less than 1%. The CVSS score of 5.5 reflects moderate severity. No known exploitation is currently reported and the CVE is not listed in the CISA KEV catalog. The memory leak can be triggered when beacon template setup fails; repeated failures may exhaust kernel memory, potentially causing out‑of‑memory conditions or system instability. While the vulnerability does not enable code execution, the resulting denial of service could affect availability of the system, particularly in long‑running deployments or those with high Wi‑Fi traffic.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`335a92765d308dfe22826f5562cd4b4389b45e71`	affected	< 7bedc489611f01634cec20f88f961a1f08e8d935
`335a92765d308dfe22826f5562cd4b4389b45e71`	affected	< 9478aa5b39e986d45fafe279c24d3546783c22b1
`335a92765d308dfe22826f5562cd4b4389b45e71`	affected	< 5fc3d921512d31839227a2d22a2990de02acefeb
`335a92765d308dfe22826f5562cd4b4389b45e71`	affected	< 5d63aa38d5ca85206d9699ffdd616b58780dba07
`335a92765d308dfe22826f5562cd4b4389b45e71`	affected	< ff49eba595df500e4ddccc593088c8a4ab5f2c27

Linux

affected

Version	Status	Constraints
`6.5`	affected	—
`0`	unaffected	< 6.5
`6.6.160`	unaffected	≤ 6.6.*
`6.12.109`	unaffected	≤ 6.12.*
`6.18.50`	unaffected	≤ 6.18.*
`7.0.10`	unaffected	≤ 7.0.*
`7.1`	unaffected	≤ *

Configuration 1 [-]

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

No data.

Vendor Product Versions

Linux

Linux Kernel

Version	Status	Scheme	Platform
`[335a92765d308dfe22826f5562cd4b4389b45e71,5d63aa38d5ca85206d9699ffdd616b58780dba07)`	affected	code_commit	—
`[335a92765d308dfe22826f5562cd4b4389b45e71,ff49eba595df500e4ddccc593088c8a4ab5f2c27)`	affected	code_commit	—

Linux

Linux Kernel

Version	Status	Scheme	Platform
`6.5`	affected	generic	—
`[0,6.5)`	unaffected	generic	—
`[7.0.10,7.1.0)`	unaffected	semver	—
`[7.1,*]`	unaffected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply the latest Linux kernel release that includes the ath11k memory‑leak fix (commit 5d63aa38d5ca85206d9699ffdd616b58780dba07). If upgrading is not feasible, backport the fix to your kernel source.
Disable or restrict the use of multiband beacon templates (MBSSID) if your deployment does not require them, thereby reducing exposure to the faulty code path.
Monitor kernel logs (dmesg, /var/log/kern.log) for memory allocation failures or out‑of‑memory events, and take corrective action such as reloading the ath11k module or rebooting when sustained memory growth is observed.
Ensure that Wi‑Fi configuration and firmware is sourced from trusted vendors to avoid triggering the flawed beacon‑template setup.

Generated by OpenCVE AI on August 12, 2026 at 07:22 UTC.

Tracking

Advisories

Source	ID	Title
Debian DLA	DLA-4817-1	linux-6.12 security update
Debian DSA	DSA-6528-1	linux security update
Ubuntu USN	USN-8566-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8568-1	Linux kernel (OEM) vulnerabilities
Ubuntu USN	USN-8569-1	Linux kernel (HWE) vulnerabilities
Ubuntu USN	USN-8593-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8603-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-8618-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8663-1	Linux kernel (NVIDIA) vulnerabilities
Ubuntu USN	USN-8664-1	Linux kernel (NVIDIA BaseOS) vulnerabilities
Ubuntu USN	USN-8728-1	Linux kernel (GCP) vulnerabilities
Ubuntu USN	USN-8728-2	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-8728-3	Linux kernel (Oracle) vulnerabilities
Ubuntu USN	USN-9022-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9023-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9024-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9025-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9026-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-9039-1	Linux kernel (Azure CVM) vulnerabilities
Ubuntu USN	USN-9040-1	Linux kernel (Low Latency NVIDIA) vulnerabilities
Ubuntu USN	USN-9066-1	Linux kernel (HWE) vulnerabilities
Ubuntu USN	USN-9091-1	Linux kernel (NVIDIA Tegra) vulnerabilities

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.121% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://git.kernel.org/stable/c/5d63aa38d5ca85206d9699ffdd616b58780dba07
https://git.kernel.org/stable/c/5fc3d921512d31839227a2d22a2990de02acefeb
https://git.kernel.org/stable/c/7bedc489611f01634cec20f88f961a1f08e8d935
https://git.kernel.org/stable/c/9478aa5b39e986d45fafe279c24d3546783c22b1
https://git.kernel.org/stable/c/ff49eba595df500e4ddccc593088c8a4ab5f2c27
https://lore.kernel.org/linux-cve-announce/2026062414-CVE-2026-53113-c4f2@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-53113
https://www.cve.org/CVERecord?id=CVE-2026-53113

History

Nov 7, 2026 7:30 AM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Oct 21, 2026 1:00 PM Added references View changes

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/7bedc489611f01634cec20f88f961a1f08e8d935

Sep 7, 2026 4:00 PM Added references View changes

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/5fc3d921512d31839227a2d22a2990de02acefeb https://git.kernel.org/stable/c/9478aa5b39e986d45fafe279c24d3546783c22b1

Jun 27, 2026 3:00 AM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses	CWE-391

Jun 27, 2026 12:15 AM Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-772
References		https://lore.kernel.org/linux-cve-announce/2026062414-CVE-2026-53113-c4f2@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-53113 https://www.cve.org/CVERecord?id=CVE-2026-53113
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Low`

Jun 24, 2026 9:30 PM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-391

Jun 24, 2026 5:15 PM Description updated. Title updated. First appearance in the feed. Affected versions updated. Affected vendors updated. Added references View changes

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: fix memory leaks in beacon template setup The functions ath11k_mac_setup_bcn_tmpl_ema() and ath11k_mac_setup_bcn_tmpl_mbssid() allocate memory for beacon templates but fail to free it when parameter setup returns an error. Since beacon templates must be released during normal execution, they must also be released in the error handling paths to prevent memory leaks. Fix this by using unified exit paths with proper cleanup in the respective error paths. Compile tested only. Issue found using a prototype static analysis tool and code review.
Title		wifi: ath11k: fix memory leaks in beacon template setup
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/5d63aa38d5ca85206d9699ffdd616b58780dba07 https://git.kernel.org/stable/c/ff49eba595df500e4ddccc593088c8a4ab5f2c27