CVE-2026-80941: Linux Kernel rtw88 Use-After-Free Vulnerability

CVE-2026-80941 Overview

CVE-2026-80941 is a memory leak vulnerability in the Linux kernel's rtw88 Wi-Fi driver. The flaw resides in the rtw_txq_push_skb() function, which fails to free a socket buffer (skb) on the error path when rtw_hci_tx_write() returns a failure. Because rtw_txq_push() dequeues an skb before passing it to rtw_txq_push_skb(), each failed transmit attempt leaks kernel memory tied to that buffer. Over time, this exhausts system memory on hosts using Realtek 802.11ac Wi-Fi chipsets supported by the rtw88 driver.

Critical Impact
Repeated transmit failures on affected Realtek wireless hardware can drain kernel memory, degrade system stability, and eventually trigger out-of-memory conditions on long-running Linux systems.

Affected Products

Linux kernel builds containing the rtw88 Wi-Fi driver prior to the eight stable patch commits listed in the references
Systems using Realtek Wi-Fi hardware supported by rtw88 (for example RTL8822BE, RTL8822CE, RTL8821CE, RTL8723DE)
Linux distributions shipping vulnerable kernel branches until stable backports are applied

Discovery Timeline

2026-09-11 - CVE-2026-80941 published to NVD
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-80941

Vulnerability Analysis

The defect is a classic driver-layer memory leak. In rtw_txq_push(), an skb is dequeued from a transmit queue and handed to rtw_txq_push_skb(). That helper calls rtw_hci_tx_write() to submit the frame to the host controller interface. The contract expects the caller to release the skb when rtw_hci_tx_write() returns an error. The pre-patch error path in rtw_txq_push_skb() returns early without calling dev_kfree_skb_any() or an equivalent release function, orphaning the buffer.

Each leaked skb consumes kernel slab memory plus the associated data payload. Under normal transmit failure rates the leak is slow. Under sustained failure conditions (poor signal, HCI errors, firmware faults, or fuzzing) the leak accelerates. The issue does not require an attacker to authenticate to the wireless network to be triggered locally, but exploitation as a denial-of-service vector requires the ability to induce repeated HCI transmit failures.

Root Cause

The root cause is missing cleanup on an error return path inside rtw_txq_push_skb(). The function violated the ownership contract of rtw_hci_tx_write(), which expects failed submissions to result in the caller freeing the buffer. This is a Memory Leak defect within a kernel driver.

Attack Vector

The attack vector is local to systems running the vulnerable driver on Realtek Wi-Fi hardware. Any condition that causes rtw_hci_tx_write() to fail repeatedly, whether environmental interference, adjacent malicious RF activity, or a local unprivileged workload generating high volumes of egress traffic under adverse link conditions, incrementally consumes kernel memory. No verified proof of concept has been published.

No verified exploit code is available. See the upstream stable patch commits referenced below for the corrective fix, which adds the missing skb release on the error path.

Detection Methods for CVE-2026-80941

Indicators of Compromise

Steadily rising kernel slab consumption on hosts using the rtw88 driver, visible in /proc/slabinfo for skbuff_head_cache and related caches
Growing Unreclaim and SUnreclaim values in /proc/meminfo correlated with sustained Wi-Fi transmit errors
Kernel log entries from the rtw88 driver reporting HCI transmit failures preceding memory pressure or OOM-killer events

Detection Strategies

Monitor kernel version and loaded module metadata across the fleet to identify hosts running unpatched rtw88 drivers
Correlate Wi-Fi transmit error counters from ip -s link or ethtool -S with kernel memory trend data over multi-day windows
Baseline slab allocator behavior on Wi-Fi-connected Linux endpoints and alert on sustained upward drift without corresponding workload growth

Monitoring Recommendations

Ingest kernel logs and node exporter metrics (memory, slab, network error counters) into a centralized analytics platform for long-window trend analysis
Alert on OOM-killer invocations on endpoints that also report rtw88 HCI errors within the preceding hours
Track kernel package versions against upstream stable branches to confirm the fix commits are present

How to Mitigate CVE-2026-80941

Immediate Actions Required

Update to a Linux kernel that includes one of the stable fix commits referenced below, then reboot affected hosts
Inventory endpoints and embedded systems using Realtek Wi-Fi chipsets bound to the rtw88 driver and prioritize their patch cycles
Reduce exposure on long-running systems by rebooting or reloading the rtw88 module during maintenance windows until patched

Patch Information

The fix has been merged across multiple stable kernel branches. Apply the appropriate commit for your kernel line: Kernel Patch Commit #51d8b35, Kernel Patch Commit #68676ce, Kernel Patch Commit #6e95852, Kernel Patch Commit #7364713, Kernel Patch Commit #924e75a, Kernel Patch Commit #9f29480, Kernel Patch Commit #c861993, and Kernel Patch Commit #e8fd571. The patches free the dequeued skb on the rtw_hci_tx_write() failure path inside rtw_txq_push_skb().

Workarounds

Blacklist the rtw88 module and switch to a wired connection on systems that do not require the affected wireless hardware
Schedule periodic reboots or modprobe -r rtw88 && modprobe rtw88 cycles to reclaim leaked memory until the patch is applied
Constrain workloads that generate high transmit volume on unstable Wi-Fi links to slow the leak rate

bash

# Verify the running kernel and rtw88 module status
uname -r
lsmod | grep rtw88

# Temporarily unload rtw88 to reclaim leaked skb memory (requires wired fallback)
sudo modprobe -r rtw88_pci rtw88_core

# After applying a patched kernel package, reboot and confirm
sudo reboot