High 7.8Published Apr 3, 2026

CVE-2026-23444wifi: mac80211: always free skb on ieee80211_tx_prepare_skb() failure

Updated under an hour ago (Oct 28, 2026, 4:30 AM ET)

Does this affect you?

It affects Linux and 2 other products. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: always free skb on ieee80211_tx_prepare_skb() failure ieee80211_tx_prepare_skb() has three error paths, but only two of them free the skb. The first error path (ieee80211_tx_prepare() returning TX_DROP) does not free it, while invoke_tx_handlers() failure and the fragmentation check both do. Add kfree_skb() to the first error path so all three are consistent, and remove the now-redundant frees in callers (ath9k, mt76, mac80211_hwsim) to avoid double-free. Document the skb ownership guarantee in the function's kdoc.

CVSS: 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): CWE-401
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Modified
Record last updated: Oct 19, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 06be6b149f7e406bcf16098567f5a6c9f042bced before 905ef207d5ed99ca64adfe39fba9ac46e434327a; 06be6b149f7e406bcf16098567f5a6c9f042bced builds before 5ef8ca1c164786da24169af155c1ca1ff1353cf8; from 06be6b149f7e406bcf16098567f5a6c9f042bced before 9a779d1f480e83720b5384adf165604e7ee226bd; from 06be6b149f7e406bcf16098567f5a6c9f042bced before f77b51bcee7be2bb686b5f7a2d4a1921e4bdb9f4; 06be6b149f7e406bcf16098567f5a6c9f042bced builds before 3b4d27acafaeab478fd24f79ad6e593a892828b9; from 06be6b149f7e406bcf16098567f5a6c9f042bced before 06e769dddcbeb3baf2ce346273b53dd61fdbecf4; from 06be6b149f7e406bcf16098567f5a6c9f042bced before 50f1b690b4868923fbd242298def2fb88662f108; from 06be6b149f7e406bcf16098567f5a6c9f042bced before d5ad6ab61cbd89afdb60881f6274f74328af3ee9	CNA record
Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem siemens:simatic_s7_1500_tm_mfp_gnu_linux_subsystem (from the name)	all versions	CISA ADP
linux linux_kernel linux:linux_kernel	from 3.13.1 before 6.18.20; from 6.19 before 6.19.10; 3.13; 7.0; 7.0; 7.0; 7.0; 7.0; and 2 more ranges	NVD

References

References

https://git.kernel.org/stable/c/905ef207d5ed99ca64adfe39fba9ac46e434327a
https://git.kernel.org/stable/c/5ef8ca1c164786da24169af155c1ca1ff1353cf8
https://git.kernel.org/stable/c/9a779d1f480e83720b5384adf165604e7ee226bd
https://git.kernel.org/stable/c/f77b51bcee7be2bb686b5f7a2d4a1921e4bdb9f4
https://git.kernel.org/stable/c/3b4d27acafaeab478fd24f79ad6e593a892828b9
https://git.kernel.org/stable/c/06e769dddcbeb3baf2ce346273b53dd61fdbecf4	patch
https://git.kernel.org/stable/c/50f1b690b4868923fbd242298def2fb88662f108	patch
https://git.kernel.org/stable/c/d5ad6ab61cbd89afdb60881f6274f74328af3ee9	patch
https://cert-portal.siemens.com/productcert/html/ssa-784472.html

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.