CVE-2026-53113: Linux Kernel Memory Leak Vulnerability

CVE-2026-53113 Overview

CVE-2026-53113 is a memory leak vulnerability in the Linux kernel's ath11k Wi-Fi driver. The flaw resides in the beacon template setup routines ath11k_mac_setup_bcn_tmpl_ema() and ath11k_mac_setup_bcn_tmpl_mbssid(). Both functions allocate memory for beacon templates but fail to release it when parameter setup returns an error. Repeated error conditions cause unbounded kernel memory consumption on systems using Qualcomm Atheros ath11k wireless chipsets. The issue was identified through a prototype static analysis tool and code review, and was resolved in upstream Linux kernel commits.

Critical Impact
Repeated failures in beacon template configuration can exhaust kernel memory, leading to denial-of-service conditions on affected wireless access points and stations.

Affected Products

Linux kernel ath11k Wi-Fi driver (Qualcomm Atheros 802.11ax)
Linux distributions shipping vulnerable kernel versions prior to the upstream fix
Systems acting as access points using ath11k-based hardware

Discovery Timeline

2026-06-24 - CVE-2026-53113 published to NVD
2026-06-24 - Last updated in NVD database

Technical Details for CVE-2026-53113

Vulnerability Analysis

The vulnerability is a memory leak [CWE-401] in the Linux kernel ath11k wireless driver. The driver supports Qualcomm Atheros 802.11ax chipsets and implements beacon template setup for two operating modes. The first mode, Enhanced Multi-BSSID Advertisement (EMA), is handled by ath11k_mac_setup_bcn_tmpl_ema(). The second mode, Multi-BSSID (MBSSID), is handled by ath11k_mac_setup_bcn_tmpl_mbssid().

Both functions allocate kernel memory to construct beacon templates before transmitting them to the firmware. When parameter setup returns an error after allocation, the functions return without releasing the allocated beacon templates. Because beacon templates must be released during normal execution, the missing free in the error path leaves the allocations orphaned in kernel memory.

The upstream fix introduces unified exit paths that properly release beacon templates in both success and error scenarios. The patch was identified through static analysis tooling and confirmed via code review. The fix was compile tested only by the contributor.

Root Cause

The root cause is incomplete error handling in beacon template construction. The original code paths used direct return statements on failure rather than a goto-based unified cleanup pattern. Each early return after a successful template allocation skipped the corresponding free, leaking memory each time the error branch executed.

Attack Vector

An attacker positioned within wireless range of an affected access point could repeatedly trigger conditions that cause beacon parameter setup to fail. Each failure leaks kernel memory associated with the beacon template. Over time, sustained triggering exhausts kernel allocations and degrades system stability. The vulnerability does not provide code execution or information disclosure primitives. Exploitation requires the ability to influence beacon configuration parameters or trigger error conditions in the driver. No public proof-of-concept is available, and there is no evidence of in-the-wild exploitation.

The vulnerability mechanism is described in prose because no verified exploitation code is publicly available. Refer to the upstream commits for the precise code changes.

Detection Methods for CVE-2026-53113

Indicators of Compromise

Progressive growth in kernel Slab and SUnreclaim values reported by /proc/meminfo on systems using ath11k hardware
Repeated ath11k driver error messages in dmesg correlated with beacon configuration changes
Wireless interface instability or firmware command failures on ath11k-based access points

Detection Strategies

Compare running kernel version against the fixed commits 5d63aa38d5ca and ff49eba595df using uname -r and distribution package metadata
Monitor long-running access points for unexplained kernel memory growth using kmemleak when enabled in development kernels
Audit wireless driver logs for repeated beacon template setup failures preceding memory pressure events

Monitoring Recommendations

Track kernel slab allocator metrics on hosts running ath11k to identify slow leaks over hours or days
Alert when systems with ath11k hardware show sustained free-memory decline without corresponding workload increase
Centralize dmesg and journalctl output from wireless infrastructure for retrospective analysis of driver error sequences

How to Mitigate CVE-2026-53113

Immediate Actions Required

Inventory all Linux systems using ath11k-based wireless chipsets, including access points and embedded devices
Apply vendor kernel updates that include the upstream patches as soon as they are available from your distribution
Restart affected hosts after patching to clear any memory already leaked by the vulnerable code paths

Patch Information

The fix has been merged upstream. See the kernel git commits for the applied changes: Kernel patch 5d63aa38d5ca and Kernel patch ff49eba595df. Both patches introduce unified exit paths in ath11k_mac_setup_bcn_tmpl_ema() and ath11k_mac_setup_bcn_tmpl_mbssid() so that allocated beacon templates are freed in error paths.

Workarounds

Disable EMA and MBSSID features on ath11k access points if business requirements permit, reducing exposure to the affected code paths
Schedule periodic restarts of access points running unpatched kernels to reclaim leaked kernel memory
Restrict management access to wireless configuration interfaces to limit the ability to trigger repeated beacon parameter failures

bash

# Verify installed kernel version and confirm patch inclusion
uname -r

# Check whether the ath11k module is loaded
lsmod | grep ath11k

# Inspect kernel ring buffer for ath11k beacon errors
dmesg | grep -i ath11k