Medium 5.5Published Jul 19, 2026

CVE-2026-64155wifi: ath11k: fix error path leaks in some WMI WOW calls

Updated under an hour ago (Oct 27, 2026, 2:30 AM ET)

Does this affect you?

It affects Linux and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: fix error path leaks in some WMI WOW calls Fix two instances where we used to directly return the result of ath11k_wmi_cmd_send(...). Because we did not check the return value, we also did not free the skb in the error path.

CVSS: 5.5 MEDIUM (v3.1, NVD)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Analyzed
Record last updated: Jul 19, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 79802b13a492d0fdeb922e98628e5ff1a8b74026 before d6c7b8d0dc22c0a8743435db8f42d98524b70df3; from 79802b13a492d0fdeb922e98628e5ff1a8b74026 before cd43d587dd333517c806cd24696e6e1a26b9951e; 79802b13a492d0fdeb922e98628e5ff1a8b74026 builds before 3d675896ea03aca631852a2a7e91e6cb8f664967; 79802b13a492d0fdeb922e98628e5ff1a8b74026 builds before 008955b1348452de25bc19d6e0f0f673d4cb9a3c; from 79802b13a492d0fdeb922e98628e5ff1a8b74026 before acde4692afcdaea6de3e2996ddfaeaa7ae6b0130; from 79802b13a492d0fdeb922e98628e5ff1a8b74026 before d618d322b95c80d5ad7091f35a7193e4050dcc27; 79802b13a492d0fdeb922e98628e5ff1a8b74026 builds before 55dda532bbc261aef495e403c8900c5e2ab5fa34	CNA record
linux linux_kernel linux:linux_kernel	from 5.11 before 5.15.209; from 5.16 before 6.1.175; from 6.2 before 6.6.142; from 6.7 before 6.12.92; from 6.13 before 6.18.34; from 6.19 before 7.0.11; 7.1; 7.1; and 2 more ranges	NVD

References

References

https://git.kernel.org/stable/c/d6c7b8d0dc22c0a8743435db8f42d98524b70df3	patch
https://git.kernel.org/stable/c/cd43d587dd333517c806cd24696e6e1a26b9951e	patch
https://git.kernel.org/stable/c/3d675896ea03aca631852a2a7e91e6cb8f664967	patch
https://git.kernel.org/stable/c/008955b1348452de25bc19d6e0f0f673d4cb9a3c	patch
https://git.kernel.org/stable/c/acde4692afcdaea6de3e2996ddfaeaa7ae6b0130	patch
https://git.kernel.org/stable/c/d618d322b95c80d5ad7091f35a7193e4050dcc27	patch
https://git.kernel.org/stable/c/55dda532bbc261aef495e403c8900c5e2ab5fa34	patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.