CVE-2026-23444 wifi: mac80211: always free skb on ieee80211_tx_prepare_skb() failure
A memory leak in the Linux kernel Wi-Fi subsystem allows attackers to cause denial of service by triggering specific transmission failures.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-23444?
CVE-2026-23444 is a high-severity memory corruption vulnerability in Linux kernel, published on 3 Apr 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
wifi: mac80211: always free skb on ieee80211_tx_prepare_skb() failure
ieee80211_tx_prepare_skb() has three error paths, but only two of them free the skb. The first error path (ieee80211_tx_prepare() returning TX_DROP) does not free it, while invoke_tx_handlers() failure and the fragmentation check both do.
Add kfree_skb() to the first error path so all three are consistent, and remove the now-redundant frees in callers (ath9k, mt76, mac80211_hwsim) to avoid double-free.
Document the skb ownership guarantee in the function's kdoc.
Weakness: CWE-401
Which versions are affected by CVE-2026-23444?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-23444?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-23444 being exploited?
There is no known exploitation of CVE-2026-23444 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as AZL-81837, BELL-CVE-2026-23444, DEBIAN-CVE-2026-23444, GHSA-84pr-vgrv-386j, ROOT-OS-DEBIAN-11-CVE-2026-23444, ROOT-OS-DEBIAN-12-CVE-2026-23444 and 4 more.