CVE-2026-23444: Linux Kernel Use-After-Free Vulnerability

CVE-2026-23444 Overview

A memory management vulnerability has been identified in the Linux kernel's mac80211 WiFi subsystem. The ieee80211_tx_prepare_skb() function contains inconsistent error handling across its three error paths, with only two of them properly freeing the socket buffer (skb). This inconsistency can lead to memory leaks during WiFi transmission failures and potential double-free conditions in affected WiFi drivers.

Critical Impact

This vulnerability affects Linux kernel systems using the mac80211 WiFi stack, potentially causing memory leaks and system instability. Affected drivers include ath9k, mt76, and mac80211_hwsim.

Affected Products

• Linux kernel mac80211 WiFi subsystem
• Systems using ath9k WiFi driver
• Systems using mt76 WiFi driver
• Systems using mac80211_hwsim driver

Discovery Timeline

• 2026-04-03 - CVE CVE-2026-23444 published to NVD
• 2026-04-07 - Last updated in NVD database

Technical Details for CVE-2026-23444

Vulnerability Analysis

The vulnerability exists within the ieee80211_tx_prepare_skb() function in the Linux kernel's mac80211 WiFi implementation. This function is responsible for preparing socket buffers (skbs) for transmission over WiFi interfaces. The function has three distinct error paths that can be triggered during transmission preparation:

1. When ieee80211_tx_prepare() returns TX_DROP
2. When invoke_tx_handlers() fails
3. When the fragmentation check fails

The core issue is that the first error path (when ieee80211_tx_prepare() returns TX_DROP) does not free the skb, while the other two error paths properly call kfree_skb() to release the buffer. This inconsistency creates a memory leak when the first error condition is triggered.

Additionally, WiFi drivers that call ieee80211_tx_prepare_skb() (including ath9k, mt76, and mac80211_hwsim) attempted to compensate for this inconsistency by implementing their own skb freeing logic. However, this approach can lead to double-free conditions when the function's error paths do free the skb properly.

Root Cause

The root cause is inconsistent memory management in the ieee80211_tx_prepare_skb() function's error handling. The function lacks a clear ownership contract for the skb across all error paths, leading to ambiguous behavior where some paths free the buffer and others do not. This violates the principle of consistent resource cleanup and creates confusion for callers about when they need to free the skb themselves.

Attack Vector

This vulnerability is primarily a reliability and stability issue rather than a direct security exploit vector. An attacker with local access or the ability to trigger WiFi transmission errors could potentially:

• Cause memory exhaustion through repeated triggering of the memory leak condition
• Destabilize the system by triggering double-free conditions through driver interactions
• Potentially exploit the memory corruption caused by double-free for privilege escalation

The vulnerability requires the ability to influence WiFi transmission behavior, which may be achievable through malformed wireless frames or by manipulating network conditions that trigger the specific error paths.

Detection Methods for CVE-2026-23444

Indicators of Compromise

• Unexplained memory consumption increases on systems with active WiFi interfaces
• Kernel log messages indicating memory allocation failures in the mac80211 subsystem
• System instability or crashes related to WiFi driver operations
• Double-free warnings or kernel panics in slab allocator logs

Detection Strategies

• Monitor kernel logs for mac80211-related error messages and memory warnings
• Track system memory usage for unexplained growth patterns on WiFi-enabled systems
• Use kernel memory debugging tools (KASAN, KMEMLEAK) to detect memory leaks and double-frees
• Review dmesg output for slab corruption or use-after-free warnings in network-related subsystems

Monitoring Recommendations

• Enable kernel memory debugging options in development and testing environments
• Deploy monitoring for kernel panic events and memory exhaustion conditions
• Track WiFi subsystem health metrics including transmission error rates
• Implement alerting for unusual memory consumption patterns on affected systems

How to Mitigate CVE-2026-23444

Immediate Actions Required

• Update the Linux kernel to a patched version that includes the fix for this vulnerability
• Review and update WiFi drivers (ath9k, mt76, mac80211_hwsim) to remove redundant skb freeing
• Consider disabling WiFi on critical systems until patches can be applied if experiencing stability issues
• Monitor affected systems for signs of memory exhaustion or instability

Patch Information

The fix has been merged into the Linux kernel stable branches. The patch adds kfree_skb() to the first error path in ieee80211_tx_prepare_skb() to ensure consistent cleanup across all three error paths. Additionally, the patch removes the now-redundant free operations in the caller drivers (ath9k, mt76, mac80211_hwsim) to prevent double-free conditions.

The patch also updates the function's kernel documentation (kdoc) to clearly document the skb ownership guarantee, making the API contract explicit for future driver developers.

Relevant kernel commits can be found at:

• Kernel.org Commit 06e769d
• Kernel.org Commit 50f1b69
• Kernel.org Commit d5ad6ab

Workarounds

• If immediate patching is not possible, consider temporarily switching to wired network connections on critical systems
• Reduce WiFi transmission activity where possible to minimize exposure to the vulnerable code paths
• Enable kernel memory debugging to detect and respond to memory issues more quickly
• Implement system monitoring and automatic restart procedures for systems experiencing memory exhaustion