CVE-2026-53258: Linux Kernel Use-After-Free Vulnerability

CVE-2026-53258 Overview

CVE-2026-53258 is a memory leak vulnerability in the Linux kernel's cfg80211 wireless subsystem. The flaw affects split 6 GHz scanning, where rdev->int_scan_req is leaked when cfg80211_scan() fails. The buffer is supposed to be released at ___cfg80211_scan_done(), but rdev->scan_req is NULL at that point, causing the freeing function to return early without releasing the allocation. The issue was identified by the Linux Verification Center (linuxtesting.org) via kmemleak instrumentation while running wpa_supplicant. The vulnerability was published on June 25, 2026, and has been resolved across the affected stable kernel branches.

Critical Impact
Repeated failed 6 GHz scan requests slowly exhaust kernel memory, leading to resource exhaustion on long-running Linux systems with Wi-Fi 6E hardware.

Affected Products

Linux kernel cfg80211 wireless subsystem
Systems with Wi-Fi hardware supporting 6 GHz band scanning
Stable kernel branches receiving commits a24134d, e8694f7, and fb8db81

Discovery Timeline

2026-06-25 - CVE-2026-53258 published to NVD
2026-06-25 - Last updated in NVD database

Technical Details for CVE-2026-53258

Vulnerability Analysis

The vulnerability is a kernel memory leak ([CWE-401]) in the wireless configuration subsystem cfg80211. When userspace triggers a scan via netlink (for example, wpa_supplicant calling nl80211_trigger_scan), the kernel allocates an internal scan request structure stored in rdev->int_scan_req. For split 6 GHz scans, the code path issues a follow-up cfg80211_scan() call. If that call fails, the allocated int_scan_req is never freed.

The normal release path runs in ___cfg80211_scan_done(). However, that function checks rdev->scan_req and returns early when it is NULL. Because the failure occurred before scan_req was assigned, the cleanup is skipped and the buffer is orphaned. The kmemleak report shows a 512-byte allocation backtrace originating in cfg80211_scan+0x133/0x730 and ending in __x64_sys_sendmsg.

Root Cause

The root cause is asymmetric ownership handling between the allocation site in cfg80211_scan() and the cleanup site in ___cfg80211_scan_done(). The cleanup function gates release on the wrong field (scan_req) and does not account for the case where int_scan_req is set but scan_req has not yet been populated due to an earlier failure in the split 6 GHz code path.

Attack Vector

A local user with permission to trigger Wi-Fi scans (via nl80211 netlink, typically CAP_NET_ADMIN or through the standard supplicant) can repeatedly initiate 6 GHz scans that fail. Each failure leaks a 512-byte kernel allocation. Over time this leads to denial of service through kernel memory exhaustion. The vulnerability is not remotely exploitable and does not provide code execution or privilege escalation. No public proof-of-concept exploit code is available, and no exploit is required beyond inducing scan failures on a vulnerable Wi-Fi stack.

The vulnerability has no published proof-of-concept exploit. See the
upstream commits referenced below for the patch diff and reproduction
context from the Linux Verification Center.

Detection Methods for CVE-2026-53258

Indicators of Compromise

Kmemleak reports referencing cfg80211_scan in the allocation backtrace with __kmalloc_noprof and nl80211_trigger_scan on the call path.
Unexplained growth in kernel Slab or SUnreclaim values in /proc/meminfo on hosts with active Wi-Fi 6E scanning.
Repeated failed scan requests logged by wpa_supplicant or iw against 6 GHz channels.

Detection Strategies

Enable CONFIG_DEBUG_KMEMLEAK on test systems and inspect /sys/kernel/debug/kmemleak for allocations rooted in cfg80211_scan.
Compare running kernel version and uname -r output against the patched stable branches containing commits a24134d, e8694f7, or fb8db81.
Audit endpoint telemetry for repeated nl80211_trigger_scan failures correlated with sustained kernel memory growth.

Monitoring Recommendations

Collect /proc/meminfo and /proc/slabinfo metrics at regular intervals and alert on sustained kmalloc-512 growth.
Monitor dmesg for cfg80211 scan failure messages and Wi-Fi driver errors.
Track wireless supplicant logs for scan retry storms that could amplify the leak.

How to Mitigate CVE-2026-53258

Immediate Actions Required

Upgrade the Linux kernel to a stable release that includes commits a24134d, e8694f7, and fb8db81.
Inventory hosts with Wi-Fi 6E hardware and prioritize patching long-running systems where memory exhaustion is most likely to manifest.
Restrict CAP_NET_ADMIN and netlink scan triggers to trusted services only.

Patch Information

The fix is distributed across three upstream commits that correct the cleanup logic so that rdev->int_scan_req is released when cfg80211_scan() fails. Refer to Kernel Git Commit a24134d, Kernel Git Commit e8694f7, and Kernel Git Commit fb8db81 for the applied patches.

Workarounds

Disable 6 GHz scanning on affected hosts where Wi-Fi 6E is not required, using driver or supplicant configuration.
Schedule periodic reboots on long-running systems to reclaim leaked memory until the patch is deployed.
Constrain which users and services can issue nl80211 scan requests.

bash

# Verify kernel version and check for patch presence
uname -r
# Inspect kmemleak for cfg80211_scan allocations
echo scan > /sys/kernel/debug/kmemleak
cat /sys/kernel/debug/kmemleak | grep -A 5 cfg80211_scan