# CVE-2026-63821: wifi: rtw88: usb: fix memory leaks on USB write failures

> A memory leak in the Linux kernel's rtw88 USB Wi-Fi driver allows attackers to cause denial of service via resource exhaustion during USB write failures.

- **Severity:** Not scored
- **Exploited in the wild:** Not known
- **Login needed:** Not needed
- **Attackable:** Local or same network only
- **Victim action needed:** Not needed
- **Fix available:** Yes
- **Published:** 19 Jul 2026
- **Updated:** 17 Aug 2026
- **Also known as:** BELL-CVE-2026-63821, DEBIAN-CVE-2026-63821, GHSA-2cvr-cmj4-cjrx, UBUNTU-CVE-2026-63821

## What is CVE-2026-63821?

CVE-2026-63821 is a memory corruption vulnerability in Linux, published on 19 Jul 2026. It can only be exploited from the same machine or local network, with no action from the victim.

### Official description

In the Linux kernel, the following vulnerability has been resolved:

wifi: rtw88: usb: fix memory leaks on USB write failures

When rtw_usb_write_port() fails to submit a USB Request Block (URB)
(e.g., due to device disconnect or ENOMEM), the completion callback is
never executed.

Currently, the driver ignores the return value of rtw_usb_write_port()
in rtw_usb_write_data() and rtw_usb_tx_agg_skb(). Because these
functions rely on the completion callback to free the socket buffers
(skbs) and the transaction control block (txcb), a submission failure
results in:
1. A memory leak of the allocated skb in rtw_usb_write_data().
2. A memory leak of the txcb structure and all aggregated skbs in
   rtw_usb_tx_agg_skb().

Fix this by checking the return value of rtw_usb_write_port(). If it
fails, explicitly free the skb in rtw_usb_write_data(), and properly
purge the tx_ack_queue and free the txcb in rtw_usb_tx_agg_skb().

The issue was discovered in practice during device disconnect/reconnect
scenarios and memory pressure conditions. Tested by verifying normal TX
operation continues after the fix without regressions.

## Which versions are affected by CVE-2026-63821?


## How do I fix CVE-2026-63821?

Apply the vendor's patch.

## Is CVE-2026-63821 being exploited?

There is no known exploitation of CVE-2026-63821 in the wild and no public exploit code.

## Fix prompt for AI coding agents

```text
Check this codebase for CVE-2026-63821 and fix it if it is affected.

What it is: CVE-2026-63821 is a memory corruption vulnerability in Linux, published on 19 Jul 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Exploitation: There is no known exploitation of CVE-2026-63821 in the wild and no public exploit code.

Affected product: Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.

Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.

Reference: https://insights.sbomify.com/CVE-2026-63821/ (Markdown: https://insights.sbomify.com/CVE-2026-63821/index.md)
```

## Sources

- CVE record: https://www.cve.org/CVERecord?id=CVE-2026-63821
- NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-63821
- OSV: https://osv.dev/vulnerability/CVE-2026-63821

---
From sbomify Insights: https://insights.sbomify.com/CVE-2026-63821/
Summaries are generated and may contain mistakes; the official description above is the record.