GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-23444 (GCVE-0-2026-23444)

Vulnerability from cvelistv5 – Published: 2026-04-03 15:15 – Updated: 2026-08-05 12:21
VLAI
Title
wifi: mac80211: always free skb on ieee80211_tx_prepare_skb() failure
Summary
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: always free skb on ieee80211_tx_prepare_skb() failure ieee80211_tx_prepare_skb() has three error paths, but only two of them free the skb. The first error path (ieee80211_tx_prepare() returning TX_DROP) does not free it, while invoke_tx_handlers() failure and the fragmentation check both do. Add kfree_skb() to the first error path so all three are consistent, and remove the now-redundant frees in callers (ath9k, mt76, mac80211_hwsim) to avoid double-free. Document the skb ownership guarantee in the function's kdoc.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 06be6b149f7e406bcf16098567f5a6c9f042bced , < 905ef207d5ed99ca64adfe39fba9ac46e434327a (git)
Affected: 06be6b149f7e406bcf16098567f5a6c9f042bced , < 5ef8ca1c164786da24169af155c1ca1ff1353cf8 (git)
Affected: 06be6b149f7e406bcf16098567f5a6c9f042bced , < 9a779d1f480e83720b5384adf165604e7ee226bd (git)
Affected: 06be6b149f7e406bcf16098567f5a6c9f042bced , < f77b51bcee7be2bb686b5f7a2d4a1921e4bdb9f4 (git)
Affected: 06be6b149f7e406bcf16098567f5a6c9f042bced , < 3b4d27acafaeab478fd24f79ad6e593a892828b9 (git)
Affected: 06be6b149f7e406bcf16098567f5a6c9f042bced , < 06e769dddcbeb3baf2ce346273b53dd61fdbecf4 (git)
Affected: 06be6b149f7e406bcf16098567f5a6c9f042bced , < 50f1b690b4868923fbd242298def2fb88662f108 (git)
Affected: 06be6b149f7e406bcf16098567f5a6c9f042bced , < d5ad6ab61cbd89afdb60881f6274f74328af3ee9 (git)
guessed Create a notification for this product.
Linux Linux Affected: 3.13
Unaffected: 0 , < 3.13 (semver)
Unaffected: 5.10.258 , ≤ 5.10.* (semver)
Unaffected: 5.15.209 , ≤ 5.15.* (semver)
Unaffected: 6.1.175 , ≤ 6.1.* (semver)
Unaffected: 6.6.136 , ≤ 6.6.* (semver)
Unaffected: 6.12.84 , ≤ 6.12.* (semver)
Unaffected: 6.18.20 , ≤ 6.18.* (semver)
Unaffected: 6.19.10 , ≤ 6.19.* (semver)
Unaffected: 7.0 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wireless/ath/ath9k/channel.c",
            "drivers/net/wireless/mediatek/mt76/scan.c",
            "drivers/net/wireless/virtual/mac80211_hwsim.c",
            "include/net/mac80211.h",
            "net/mac80211/tx.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "905ef207d5ed99ca64adfe39fba9ac46e434327a",
              "status": "affected",
              "version": "06be6b149f7e406bcf16098567f5a6c9f042bced",
              "versionType": "git"
            },
            {
              "lessThan": "5ef8ca1c164786da24169af155c1ca1ff1353cf8",
              "status": "affected",
              "version": "06be6b149f7e406bcf16098567f5a6c9f042bced",
              "versionType": "git"
            },
            {
              "lessThan": "9a779d1f480e83720b5384adf165604e7ee226bd",
              "status": "affected",
              "version": "06be6b149f7e406bcf16098567f5a6c9f042bced",
              "versionType": "git"
            },
            {
              "lessThan": "f77b51bcee7be2bb686b5f7a2d4a1921e4bdb9f4",
              "status": "affected",
              "version": "06be6b149f7e406bcf16098567f5a6c9f042bced",
              "versionType": "git"
            },
            {
              "lessThan": "3b4d27acafaeab478fd24f79ad6e593a892828b9",
              "status": "affected",
              "version": "06be6b149f7e406bcf16098567f5a6c9f042bced",
              "versionType": "git"
            },
            {
              "lessThan": "06e769dddcbeb3baf2ce346273b53dd61fdbecf4",
              "status": "affected",
              "version": "06be6b149f7e406bcf16098567f5a6c9f042bced",
              "versionType": "git"
            },
            {
              "lessThan": "50f1b690b4868923fbd242298def2fb88662f108",
              "status": "affected",
              "version": "06be6b149f7e406bcf16098567f5a6c9f042bced",
              "versionType": "git"
            },
            {
              "lessThan": "d5ad6ab61cbd89afdb60881f6274f74328af3ee9",
              "status": "affected",
              "version": "06be6b149f7e406bcf16098567f5a6c9f042bced",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wireless/ath/ath9k/channel.c",
            "drivers/net/wireless/mediatek/mt76/scan.c",
            "drivers/net/wireless/virtual/mac80211_hwsim.c",
            "include/net/mac80211.h",
            "net/mac80211/tx.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.13"
            },
            {
              "lessThan": "3.13",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.258",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.209",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.175",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.136",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.84",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.20",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.258",
                  "versionStartIncluding": "3.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.209",
                  "versionStartIncluding": "3.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.175",
                  "versionStartIncluding": "3.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.136",
                  "versionStartIncluding": "3.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.84",
                  "versionStartIncluding": "3.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.20",
                  "versionStartIncluding": "3.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.10",
                  "versionStartIncluding": "3.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "3.13",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: always free skb on ieee80211_tx_prepare_skb() failure\n\nieee80211_tx_prepare_skb() has three error paths, but only two of them\nfree the skb. The first error path (ieee80211_tx_prepare() returning\nTX_DROP) does not free it, while invoke_tx_handlers() failure and the\nfragmentation check both do.\n\nAdd kfree_skb() to the first error path so all three are consistent,\nand remove the now-redundant frees in callers (ath9k, mt76,\nmac80211_hwsim) to avoid double-free.\n\nDocument the skb ownership guarantee in the function\u0027s kdoc."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable mac80211 helper is reached from local nl80211 operations such as setting wireless parameters and triggering hardware scans, not from received WiFi frames. A local attacker can drive affected scan paths through the kernel\u0027s generic netlink API.\nAC:L - The failure path can be triggered deterministically on an affected device by choosing scan parameters that produce a directed, oversized probe request with a low fragmentation threshold. No race or condition outside the attacker\u0027s control is required once the affected driver/path is available.\nPR:L - The reachable nl80211 commands are guarded by GENL_UNS_ADMIN_PERM/CAP_NET_ADMIN in the relevant network namespace, which is low privilege for CVSS purposes and can be reachable through user namespaces in plausible deployments. It does not require full init-namespace root.\nUI:N - After obtaining the needed local privileges, the attacker can issue the netlink operations directly. No separate victim action is required.\nS:U - The bug corrupts kernel networking memory within the same kernel security authority. It does not cross a VM, hypervisor, or separate security-scope boundary.\nC:H - The vulnerable failure path creates a double-free/use-after-free of an sk_buff, which is kernel heap memory corruption. Such corruption can plausibly be exploited for kernel memory disclosure, so confidentiality impact is high.\nI:H - The double-free/use-after-free can plausibly be turned into kernel heap manipulation and control-flow or data corruption. Under the required overestimate rule, this supports high integrity impact.\nA:H - Even without full exploitation, the double-free/use-after-free can trigger slab corruption, warnings, oopses, or kernel panic. Availability impact is therefore high."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:21:47.685Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/905ef207d5ed99ca64adfe39fba9ac46e434327a"
        },
        {
          "url": "https://git.kernel.org/stable/c/5ef8ca1c164786da24169af155c1ca1ff1353cf8"
        },
        {
          "url": "https://git.kernel.org/stable/c/9a779d1f480e83720b5384adf165604e7ee226bd"
        },
        {
          "url": "https://git.kernel.org/stable/c/f77b51bcee7be2bb686b5f7a2d4a1921e4bdb9f4"
        },
        {
          "url": "https://git.kernel.org/stable/c/3b4d27acafaeab478fd24f79ad6e593a892828b9"
        },
        {
          "url": "https://git.kernel.org/stable/c/06e769dddcbeb3baf2ce346273b53dd61fdbecf4"
        },
        {
          "url": "https://git.kernel.org/stable/c/50f1b690b4868923fbd242298def2fb88662f108"
        },
        {
          "url": "https://git.kernel.org/stable/c/d5ad6ab61cbd89afdb60881f6274f74328af3ee9"
        }
      ],
      "title": "wifi: mac80211: always free skb on ieee80211_tx_prepare_skb() failure",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-23444",
    "datePublished": "2026-04-03T15:15:28.464Z",
    "dateReserved": "2026-01-13T15:37:46.019Z",
    "dateUpdated": "2026-08-05T12:21:47.685Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-23444",
      "date": "2026-09-18",
      "epss": "0.00129",
      "percentile": "0.02936"
    },
    "microsoft_vex": {
      "current_release_date": "2026-05-02T14:38:26.000Z",
      "cve": "CVE-2026-23444",
      "id": "msrc_CVE-2026-23444",
      "initial_release_date": "2026-04-02T00:00:00.000Z",
      "product_status:fixed": "1",
      "product_status:known_affected": "3",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "wifi: mac80211: always free skb on ieee80211_tx_prepare_skb() failure",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-23444.json",
      "version": "5"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/net/wireless/ath/ath9k/channel.c",
                  "drivers/net/wireless/mediatek/mt76/scan.c",
                  "drivers/net/wireless/virtual/mac80211_hwsim.c",
                  "include/net/mac80211.h",
                  "net/mac80211/tx.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "905ef207d5ed99ca64adfe39fba9ac46e434327a",
                    "status": "affected",
                    "version": "06be6b149f7e406bcf16098567f5a6c9f042bced",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "5ef8ca1c164786da24169af155c1ca1ff1353cf8",
                    "status": "affected",
                    "version": "06be6b149f7e406bcf16098567f5a6c9f042bced",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "9a779d1f480e83720b5384adf165604e7ee226bd",
                    "status": "affected",
                    "version": "06be6b149f7e406bcf16098567f5a6c9f042bced",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "f77b51bcee7be2bb686b5f7a2d4a1921e4bdb9f4",
                    "status": "affected",
                    "version": "06be6b149f7e406bcf16098567f5a6c9f042bced",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "3b4d27acafaeab478fd24f79ad6e593a892828b9",
                    "status": "affected",
                    "version": "06be6b149f7e406bcf16098567f5a6c9f042bced",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "06e769dddcbeb3baf2ce346273b53dd61fdbecf4",
                    "status": "affected",
                    "version": "06be6b149f7e406bcf16098567f5a6c9f042bced",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "50f1b690b4868923fbd242298def2fb88662f108",
                    "status": "affected",
                    "version": "06be6b149f7e406bcf16098567f5a6c9f042bced",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "d5ad6ab61cbd89afdb60881f6274f74328af3ee9",
                    "status": "affected",
                    "version": "06be6b149f7e406bcf16098567f5a6c9f042bced",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/net/wireless/ath/ath9k/channel.c",
                  "drivers/net/wireless/mediatek/mt76/scan.c",
                  "drivers/net/wireless/virtual/mac80211_hwsim.c",
                  "include/net/mac80211.h",
                  "net/mac80211/tx.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "3.13"
                  },
                  {
                    "lessThan": "3.13",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.258",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.209",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.175",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.136",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.84",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.20",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.19.*",
                    "status": "unaffected",
                    "version": "6.19.10",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.0",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "FF3A2276-F204-45D0-888F-78B1900D361C",
                    "versionEndExcluding": "6.18.20",
                    "versionStartIncluding": "3.13.1",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "96D34333-38BE-4414-9E79-6EB764329581",
                    "versionEndExcluding": "6.19.10",
                    "versionStartIncluding": "6.19",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:3.13:-:*:*:*:*:*:*",
                    "matchCriteriaId": "0F72A71E-B6B2-40F2-A21D-BF7CE1514976",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*",
                    "matchCriteriaId": "F253B622-8837-4245-BCE5-A7BF8FC76A16",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*",
                    "matchCriteriaId": "4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*",
                    "matchCriteriaId": "F666C8D8-6538-46D4-B318-87610DE64C34",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*",
                    "matchCriteriaId": "02259FDA-961B-47BC-AE7F-93D7EC6E90C2",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*",
                    "matchCriteriaId": "58A9FEFF-C040-420D-8F0A-BFDAAA1DF258",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*",
                    "matchCriteriaId": "1D2315C0-D46F-4F85-9754-F9E5E11374A6",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*",
                    "matchCriteriaId": "512EE3A8-A590-4501-9A94-5D4B268D6138",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: always free skb on ieee80211_tx_prepare_skb() failure\n\nieee80211_tx_prepare_skb() has three error paths, but only two of them\nfree the skb. The first error path (ieee80211_tx_prepare() returning\nTX_DROP) does not free it, while invoke_tx_handlers() failure and the\nfragmentation check both do.\n\nAdd kfree_skb() to the first error path so all three are consistent,\nand remove the now-redundant frees in callers (ath9k, mt76,\nmac80211_hwsim) to avoid double-free.\n\nDocument the skb ownership guarantee in the function\u0027s kdoc."
          },
          {
            "lang": "es",
            "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nwifi: mac80211: liberar siempre skb en caso de fallo de ieee80211_tx_prepare_skb()\n\nieee80211_tx_prepare_skb() tiene tres rutas de error, pero solo dos de ellas liberan el skb. La primera ruta de error (ieee80211_tx_prepare() devolviendo TX_DROP) no lo libera, mientras que el fallo de invoke_tx_handlers() y la comprobaci\u00f3n de fragmentaci\u00f3n s\u00ed lo hacen.\n\nA\u00f1adir kfree_skb() a la primera ruta de error para que las tres sean consistentes, y eliminar las liberaciones ahora redundantes en las funciones que llaman (ath9k, mt76, mac80211_hwsim) para evitar la doble liberaci\u00f3n.\n\nDocumentar la garant\u00eda de propiedad del skb en el kdoc de la funci\u00f3n."
          }
        ],
        "id": "CVE-2026-23444",
        "lastModified": "2026-07-24T21:10:00.143",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 5.5,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 3.6,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ]
        },
        "published": "2026-04-03T16:16:28.810",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/06e769dddcbeb3baf2ce346273b53dd61fdbecf4"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/3b4d27acafaeab478fd24f79ad6e593a892828b9"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/50f1b690b4868923fbd242298def2fb88662f108"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/5ef8ca1c164786da24169af155c1ca1ff1353cf8"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/905ef207d5ed99ca64adfe39fba9ac46e434327a"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/9a779d1f480e83720b5384adf165604e7ee226bd"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/d5ad6ab61cbd89afdb60881f6274f74328af3ee9"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/f77b51bcee7be2bb686b5f7a2d4a1921e4bdb9f4"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-401"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-06-30T11:45:55+00:00",
      "cve": "CVE-2026-23444",
      "id": "CVE-2026-23444",
      "initial_release_date": "2026-04-03T00:00:00+00:00",
      "product_status:known_affected": "246",
      "product_status:known_not_affected": "28",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: wifi: mac80211: always free skb on ieee80211_tx_prepare_skb() failure",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-23444.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-11T01:36:05Z",
      "cve": "CVE-2026-23444",
      "id": "CVE-2026-23444",
      "initial_release_date": "2026-04-03T23:27:41Z",
      "product_status:first_fixed": "2",
      "product_status:known_affected": "639",
      "product_status:known_not_affected": "4",
      "product_status:recommended": "316",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-23444",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-23444.json",
      "version": "23"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.