Answer in brief
CVE-2026-63821 records a Unknown severity vulnerability in wifi: rtw88: usb: fix memory leaks on USB write failures. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=a82dfd33d1237f6c0fb8a7077022189d1fc7ec98 <2b2060c2075a72bc2de43ce5e1b9347d6c5e27bb || >=a82dfd33d1237f6c0fb8a7077022189d1fc7ec98 <53fed4061a09755de99c89fdc7fae5b794da455f || >=a82dfd33d1237f6c0fb8a7077022189d1fc7ec98 <200d58c851b8f63f77a05570072dd20f79bc3681 || >=a82dfd33d1237f6c0fb8a7077022189d1fc7ec98 <8206d173d18ef5a077423119f4e9a93cb3a6f4eb || >=a82dfd33d1237f6c0fb8a7077022189d1fc7ec98 <6b964941bbfe6e0f18b1a5e008486dbb62df440a | 2b2060c2075a72bc2de43ce5e1b9347d6c5e27bb, 53fed4061a09755de99c89fdc7fae5b794da455f, 200d58c851b8f63f77a05570072dd20f79bc3681, 8206d173d18ef5a077423119f4e9a93cb3a6f4eb, 6b964941bbfe6e0f18b1a5e008486dbb62df440a |
| Linux/Linuxgeneric | 6.2 | Not reported |
Published upstream
Jul 19, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 17, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 17, 2026
In the Linux kernel, the following vulnerability has been resolved: wifi: rtw88: usb: fix memory leaks on USB write failures When rtw_usb_write_port() fails to submit a USB Request Block (URB) (e.g., due to device disconnect or ENOMEM), the completion callback is never executed. Currently, the driver ignores the return value of rtw_usb_write_port() in rtw_usb_write_data() and rtw_usb_tx_agg_skb(). Because these functions rely on the completion callback to free the socket buffers (skbs) and the transaction control block (txcb), a submission failure results in: 1. A memory leak of the allocated skb in rtw_usb_write_data(). 2. A memory leak of the txcb structure and all aggregated skbs in rtw_usb_tx_agg_skb(). Fix this by checking the return value of rtw_usb_write_port(). If it fails, explicitly free the skb in rtw_usb_write_data(), and properly purge the tx_ack_queue and free the txcb in rtw_usb_tx_agg_skb(). The issue was discovered in practice during device disconnect/reconnect scenarios and memory pressure conditions. Tested by verifying normal TX operation continues after the fix without regressions.
Quoted source text, attributed separately from HOL analysis.