CVE-2026-23444: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23444 is a memory leak vulnerability in the Linux kernel's mac80211 WiFi subsystem, specifically in the ieee80211_tx_prepare_skb() function. The function contains three error paths, but only two of them properly free the socket buffer (skb); the first error path — when ieee80211_tx_prepare() returns TX_DROP — fails to call kfree_skb(), leading to unreleased memory. Affected Linux kernel versions span from 3.13.1 through 6.18.19, 6.19 through 6.19.9, and 7.0-rc1 through 7.0-rc4. It was published on April 3, 2026, and carries a CVSS v3.1 base score of 5.5 (Medium) (Github Advisory, Feedly).

The root cause is classified as CWE-401 (Missing Release of Memory after Effective Lifetime): the ieee80211_tx_prepare_skb() function in the mac80211 subsystem inconsistently handles skb ownership across its three error paths (Github Advisory). When ieee80211_tx_prepare() returns TX_DROP, the skb is not freed, while the other two error paths (invoke_tx_handlers() failure and the fragmentation check) do free it. The fix adds kfree_skb() to the first error path and removes now-redundant frees in callers (ath9k, mt76, mac80211_hwsim) to prevent double-free, and documents the skb ownership guarantee in the function's kdoc. Exploitation requires local access with low privileges, achieved by triggering the vulnerable error path through crafted WiFi packet processing (Feedly).

Successful exploitation allows a local attacker with low privileges to cause repeated skb allocations without proper deallocation, progressively exhausting kernel memory and resulting in a denial of service (system crash or severe degradation). The impact is limited to availability — there is no confidentiality or integrity impact. Systems running affected kernel versions with WiFi drivers (ath9k, mt76, mac80211_hwsim) are at risk, and the vulnerability does not enable lateral movement or data exfiltration (Github Advisory, Feedly).

Update the Linux kernel to a patched version: 6.18.20 or later, 6.19.10 or later, or 7.0-rc5 or later (Feedly). Specific upstream patch commits are available at the kernel stable tree for each affected branch. As a temporary measure, restricting local user access to affected systems with WiFi functionality can reduce exposure until patching is complete. SUSE has also released a kernel security update (SUSE-SU-2026:22048-1) addressing this vulnerability (Linux Security). Monitoring system memory usage for abnormal patterns on vulnerable systems is recommended.

The Yocto Project security mailing list discussed the vulnerability across multiple messages, indicating awareness in the embedded Linux community (Feedly). SUSE issued a kernel security advisory (SUSE-SU-2026:22048-1) incorporating the fix (Linux Security). No notable researcher commentary or significant social media discussion has been identified beyond standard vulnerability tracking.