GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

FKIE_CVE-2026-80941

Vulnerability from fkie_nvd - Published: 2026-09-11 20:18 - Updated: 2026-09-14 13:18
Severity
Summary
In the Linux kernel, the following vulnerability has been resolved: wifi: rtw88: Fix potential memory leak in rtw_txq_push_skb() The skb passed to the rtw_hci_tx_write() is expected to be freed when the function fails, but the error path in rtw_txq_push_skb() does not free the skb before returning. This can lead to a memory leak in rtw_txq_push() where a dequeued skb is passed to rtw_txq_push_skb().
References
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/51d8b35574721cf3fe744f46ebd9629916063fee
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/68676ce3313b74326fbcf21c673728db4c19d3cf
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/6e95852f904edbabf411793093fcfd6f6d49ef27
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/7364713f0931ee45fdf0bea27103b40ccc94979a
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/924e75a420a3000e9f189aed26f67556a62f2d57
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/9f2948010764d708bda27369d09ce6f194abe8e3
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/c86199357a93b9182854cf805d7780a213fda937
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/e8fd57157ee7a9e2986a9218198a5c1b02f2310b
Impacted products
Vendor Product Version
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wireless/realtek/rtw88/tx.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "e8fd57157ee7a9e2986a9218198a5c1b02f2310b",
              "status": "affected",
              "version": "aaab5d0e673749f82ff34e5f15ea8a689789a9ce",
              "versionType": "git"
            },
            {
              "lessThan": "924e75a420a3000e9f189aed26f67556a62f2d57",
              "status": "affected",
              "version": "aaab5d0e673749f82ff34e5f15ea8a689789a9ce",
              "versionType": "git"
            },
            {
              "lessThan": "68676ce3313b74326fbcf21c673728db4c19d3cf",
              "status": "affected",
              "version": "aaab5d0e673749f82ff34e5f15ea8a689789a9ce",
              "versionType": "git"
            },
            {
              "lessThan": "c86199357a93b9182854cf805d7780a213fda937",
              "status": "affected",
              "version": "aaab5d0e673749f82ff34e5f15ea8a689789a9ce",
              "versionType": "git"
            },
            {
              "lessThan": "6e95852f904edbabf411793093fcfd6f6d49ef27",
              "status": "affected",
              "version": "aaab5d0e673749f82ff34e5f15ea8a689789a9ce",
              "versionType": "git"
            },
            {
              "lessThan": "7364713f0931ee45fdf0bea27103b40ccc94979a",
              "status": "affected",
              "version": "aaab5d0e673749f82ff34e5f15ea8a689789a9ce",
              "versionType": "git"
            },
            {
              "lessThan": "51d8b35574721cf3fe744f46ebd9629916063fee",
              "status": "affected",
              "version": "aaab5d0e673749f82ff34e5f15ea8a689789a9ce",
              "versionType": "git"
            },
            {
              "lessThan": "9f2948010764d708bda27369d09ce6f194abe8e3",
              "status": "affected",
              "version": "aaab5d0e673749f82ff34e5f15ea8a689789a9ce",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wireless/realtek/rtw88/tx.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.7"
            },
            {
              "lessThan": "5.7",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.270",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.221",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.188",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.109",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.50",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: rtw88: Fix potential memory leak in rtw_txq_push_skb()\n\nThe skb passed to the rtw_hci_tx_write() is expected to be freed when\nthe function fails, but the error path in rtw_txq_push_skb() does not\nfree the skb before returning. This can lead to a memory leak in\nrtw_txq_push() where a dequeued skb is passed to rtw_txq_push_skb()."
    }
  ],
  "id": "CVE-2026-80941",
  "lastModified": "2026-09-14T13:18:50.160",
  "metrics": {},
  "published": "2026-09-11T20:18:59.227",
  "references": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/51d8b35574721cf3fe744f46ebd9629916063fee"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/68676ce3313b74326fbcf21c673728db4c19d3cf"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/6e95852f904edbabf411793093fcfd6f6d49ef27"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/7364713f0931ee45fdf0bea27103b40ccc94979a"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/924e75a420a3000e9f189aed26f67556a62f2d57"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/9f2948010764d708bda27369d09ce6f194abe8e3"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/c86199357a93b9182854cf805d7780a213fda937"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/e8fd57157ee7a9e2986a9218198a5c1b02f2310b"
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "vulnStatus": "Received"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.