CVE-2026-63821 Overview
CVE-2026-63821 is a memory leak vulnerability in the Linux kernel's rtw88 USB Wi-Fi driver. The flaw resides in the rtw_usb_write_port() submission path, where callers ignore the return value of URB (USB Request Block) submissions. When submission fails due to device disconnect or ENOMEM conditions, the completion callback never runs, leaving socket buffers (skbs) and transaction control blocks (txcbs) unreleased. The issue affects rtw_usb_write_data() and rtw_usb_tx_agg_skb() in the Realtek 802.11ac USB driver.
Critical Impact
Repeated USB write failures during device disconnect or memory pressure conditions leak kernel memory and can lead to resource exhaustion over time.
Affected Products
- Linux kernel branches shipping the rtw88 USB driver prior to the fix commits
- Systems using Realtek 802.11ac USB Wi-Fi adapters supported by rtw88
- Multiple stable kernel trees referenced by commits 200d58c, 2b2060c, 53fed40, 6b96494, and 8206d17
Discovery Timeline
- 2026-07-19 - CVE-2026-63821 published to NVD
- 2026-07-19 - Last updated in NVD database
Technical Details for CVE-2026-63821
Vulnerability Analysis
The rtw88 USB transmit path relies on the URB completion callback to release transmit resources. rtw_usb_write_data() allocates an skb and passes it to rtw_usb_write_port(), expecting the completion handler to free it. rtw_usb_tx_agg_skb() allocates a txcb and aggregates multiple skbs onto tx_ack_queue under the same assumption.
When usb_submit_urb() fails inside rtw_usb_write_port(), no completion callback is scheduled. Because the calling functions discard the error return, the allocated buffers remain referenced only by the failed submission path and are never freed. This produces a memory leak proportional to submission failure frequency.
Root Cause
The root cause is an unchecked return value combined with an ownership contract that assumed submission always succeeded. The completion callback held sole responsibility for freeing skb and txcb allocations, so any early failure in submission bypassed cleanup entirely. This pattern is a resource management defect rather than an attacker-controlled condition.
Attack Vector
The vulnerability triggers under legitimate operational conditions: USB Wi-Fi device disconnect or reconnect events, and kernel memory pressure returning ENOMEM from URB allocation. A local user with the ability to induce disconnect events or memory pressure could accelerate the leak, but no remote exploitation vector is documented. The impact is confined to kernel memory exhaustion and potential denial of service on long-running systems using affected adapters.
See the upstream patch commits for the exact code paths modified. The fix checks the return value of rtw_usb_write_port(), explicitly frees the skb in rtw_usb_write_data() on failure, and purges the tx_ack_queue while freeing the txcb in rtw_usb_tx_agg_skb().
Detection Methods for CVE-2026-63821
Indicators of Compromise
- Steadily increasing SLAB/kmalloc usage attributable to skbuff_head_cache on systems with rtw88 USB adapters
- Recurring USB disconnect or usb_submit_urb failure messages in dmesg correlated with kernel memory growth
- Wi-Fi TX operations continuing to allocate buffers after repeated adapter reconnect cycles
Detection Strategies
- Monitor /proc/slabinfo for growth in skbuff_head_cache and driver-specific caches on hosts using Realtek USB Wi-Fi
- Compare running kernel version against the fix commits (200d58c851b8, 2b2060c2075a, 53fed4061a09, 6b964941bbfe, 8206d173d18e)
- Correlate USB unbind or -ENOMEM events with MemAvailable decline over time
Monitoring Recommendations
- Track kernel memory metrics with node_exporter or equivalent and alert on sustained slab growth without workload change
- Log USB subsystem events via udev and journalctl -k to detect disconnect frequency on affected hosts
- Baseline TX buffer allocation counters exposed by ethtool -S or debugfs for the rtw88 driver
How to Mitigate CVE-2026-63821
Immediate Actions Required
- Update to a kernel release containing the fix commits referenced above for every affected stable branch
- Inventory hosts using Realtek 802.11ac USB adapters bound to the rtw88_usb module
- Restart long-running systems that have experienced repeated USB Wi-Fi disconnect events to reclaim leaked memory
Patch Information
The upstream fix is available in multiple stable kernel trees. Refer to Kernel Git Commit 200d58c, Kernel Git Commit 2b2060c, Kernel Git Commit 53fed40, Kernel Git Commit 6b96494, and Kernel Git Commit 8206d17. Apply the appropriate backport for your kernel branch and rebuild or install the distribution package that includes the fix.
Workarounds
- Unload the rtw88_usb module (modprobe -r rtw88_usb) on hosts that do not require the affected adapter until patching is complete
- Avoid workflows that repeatedly disconnect and reconnect Realtek USB Wi-Fi adapters on unpatched systems
- Schedule periodic reboots on unpatched hosts operating under memory pressure to reclaim leaked kernel allocations
# Verify the loaded driver and current kernel version, then unload if needed
uname -r
lsmod | grep rtw88_usb
sudo modprobe -r rtw88_usb
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
