CVE-2026-53258 - Vulnerability Details

- wifi: fix leak if split 6 GHz scanning fails

Description

In the Linux kernel, the following vulnerability has been resolved:

wifi: fix leak if split 6 GHz scanning fails

rdev->int_scan_req is leaked if cfg80211_scan() fails. Note that it's
supposed to be released at ___cfg80211_scan_done() but this doesn't happen
as rdev->scan_req is NULL at that point, too, leading to the early return
from the freeing function.

unreferenced object 0xffff8881161d0800 (size 512):
comm "wpa_supplicant", pid 379, jiffies 4294749765
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 f0 81 13 16 81 88 ff ff ................
backtrace (crc c867fdb6):
kmemleak_alloc+0x89/0x90
__kmalloc_noprof+0x2fd/0x410
cfg80211_scan+0x133/0x730
nl80211_trigger_scan+0xc69/0x1cc0
genl_family_rcv_msg_doit+0x204/0x2f0
genl_rcv_msg+0x431/0x6b0
netlink_rcv_skb+0x143/0x3f0
genl_rcv+0x27/0x40
netlink_unicast+0x4f6/0x820
netlink_sendmsg+0x797/0xce0
__sock_sendmsg+0xc4/0x160
____sys_sendmsg+0x5e4/0x890
___sys_sendmsg+0xf8/0x180
__sys_sendmsg+0x136/0x1e0
__x64_sys_sendmsg+0x76/0xc0
x64_sys_call+0x13f0/0x17d0

Found by Linux Verification Center (linuxtesting.org).

Published: 2026-06-25

Score: 5.5 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

An unreferenced kernel memory object remains allocated when a 6 GHz Wi‑Fi scan fails. The rdev->int_scan_req structure is never freed because the cleanup path is bypassed, causing a memory leak that progressively consumes system RAM and can degrade kernel responsiveness.

Affected Systems

All Linux kernel builds that include the affected wireless driver code prior to the patch, across all vendor distributions using the upstream kernel. The issue is a Linux kernel bug, not tied to a specific distribution package.

Risk and Exploitability

The flaw resides in a driver‑level memory allocation path and does not enable credential elevation or code execution. The vulnerability has a CVSS score of 5.5, indicating medium severity. The EPSS score is < 1% and the vulnerability is not listed in the CISA KEV catalog. Although exploitation is unlikely to be public, repeated failures could lead to memory exhaustion and disrupt kernel operations.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`c8cb5b854b40f2ce52ccd032fa19750f4181d5fc`	affected	< fb8db813eba2e56ee001c9fb5c2ce2cb78c42642
`c8cb5b854b40f2ce52ccd032fa19750f4181d5fc`	affected	< a24134ddc18b4d440714365637d440b7121447b9
`c8cb5b854b40f2ce52ccd032fa19750f4181d5fc`	affected	< e8694f7cc29287e843648d1075177b9a2000d957

Linux

affected

Version	Status	Constraints
`5.10`	affected	—
`0`	unaffected	< 5.10
`6.18.36`	unaffected	≤ 6.18.*
`7.0.13`	unaffected	≤ 7.0.*
`7.1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[c8cb5b854b40f2ce52ccd032fa19750f4181d5fc,fb8db813eba2e56ee001c9fb5c2ce2cb78c42642)`	affected	code_commit	—
`[c8cb5b854b40f2ce52ccd032fa19750f4181d5fc,a24134ddc18b4d440714365637d440b7121447b9)`	affected	code_commit	—
`[c8cb5b854b40f2ce52ccd032fa19750f4181d5fc,e8694f7cc29287e843648d1075177b9a2000d957)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`5.10`	affected	generic	—
`[0,5.10)`	unaffected	generic	—
`[6.18.36,6.19.0)`	unaffected	semver	—
`[7.0.13,7.1.0)`	unaffected	semver	—
`[7.1,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Update the Linux kernel to the latest release that contains the patched code for the Wi‑Fi scanning path
If an immediate kernel update is not possible, disable 6 GHz Wi‑Fi scanning or the interface that triggers the failing scan to prevent the leak from occurring
After applying the update or disabling scanning, monitor kernel memory usage for any unexpected growth using appropriate kernel monitoring tools

Generated by OpenCVE AI on June 30, 2026 at 04:21 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00117.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/a24134ddc18b4d440714365637d440b7121447b9
https://git.kernel.org/stable/c/e8694f7cc29287e843648d1075177b9a2000d957
https://git.kernel.org/stable/c/fb8db813eba2e56ee001c9fb5c2ce2cb78c42642
https://lore.kernel.org/linux-cve-announce/2026062515-CVE-2026-53258-50dc@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-53258
https://www.cve.org/CVERecord?id=CVE-2026-53258

History

Tue, 30 Jun 2026 04:45:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-401

Tue, 30 Jun 2026 02:30:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-772

Tue, 30 Jun 2026 00:45:00 +0000

Type	Values Removed	Values Added
References		https://lore.kernel.org/linux-cve-announce/2026062515-CVE-2026-53258-50dc@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-53258 https://www.cve.org/CVERecord?id=CVE-2026-53258
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Low`

Thu, 25 Jun 2026 12:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-772

Thu, 25 Jun 2026 09:15:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: wifi: fix leak if split 6 GHz scanning fails rdev->int_scan_req is leaked if cfg80211_scan() fails. Note that it's supposed to be released at ___cfg80211_scan_done() but this doesn't happen as rdev->scan_req is NULL at that point, too, leading to the early return from the freeing function. unreferenced object 0xffff8881161d0800 (size 512): comm "wpa_supplicant", pid 379, jiffies 4294749765 hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00 00 00 00 00 00 00 00 f0 81 13 16 81 88 ff ff ................ backtrace (crc c867fdb6): kmemleak_alloc+0x89/0x90 __kmalloc_noprof+0x2fd/0x410 cfg80211_scan+0x133/0x730 nl80211_trigger_scan+0xc69/0x1cc0 genl_family_rcv_msg_doit+0x204/0x2f0 genl_rcv_msg+0x431/0x6b0 netlink_rcv_skb+0x143/0x3f0 genl_rcv+0x27/0x40 netlink_unicast+0x4f6/0x820 netlink_sendmsg+0x797/0xce0 __sock_sendmsg+0xc4/0x160 ____sys_sendmsg+0x5e4/0x890 ___sys_sendmsg+0xf8/0x180 __sys_sendmsg+0x136/0x1e0 __x64_sys_sendmsg+0x76/0xc0 x64_sys_call+0x13f0/0x17d0 Found by Linux Verification Center (linuxtesting.org).
Title		wifi: fix leak if split 6 GHz scanning fails
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/a24134ddc18b4d440714365637d440b7121447b9 https://git.kernel.org/stable/c/e8694f7cc29287e843648d1075177b9a2000d957 https://git.kernel.org/stable/c/fb8db813eba2e56ee001c9fb5c2ce2cb78c42642

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-06-25T08:39:47.917Z

Updated: 2026-06-25T08:39:47.917Z

Reserved: 2026-06-09T07:44:35.394Z

Link: CVE-2026-53258

Vulnrichment

No data.

NVD

No data.

Redhat

Severity : Low

Publid Date: 2026-06-25T00:00:00Z

Links: CVE-2026-53258 - Bugzilla

OpenCVE Enrichment

Updated: 2026-06-30T04:30:04Z

Weaknesses

CWE-401
Missing Release of Memory after Effective Lifetime

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object