CVE-2026-23444
Description
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: always free skb on ieee80211_tx_prepare_skb() failure ieee80211_tx_prepare_skb() has three error paths, but only two of them free the skb. The first error path (ieee80211_tx_prepare() returning TX_DROP) does not free it, while invoke_tx_handlers() failure and the fragmentation check both do. Add kfree_skb() to the first error path so all three are consistent, and remove the now-redundant frees in callers (ath9k, mt76, mac80211_hwsim) to avoid double-free. Document the skb ownership guarantee in the function's kdoc.
Predictions
Heuristic predictions, AS-IS, for prioritization only.
Mitigations
No mitigations published for this CVE yet.
The vendor-content worker queues fetches as references arrive (check back in a few minutes). Or — if you've already worked around this in production — publish your fix to the community-verified tier.
✚ Propose a mitigation on Community → Mitigations published via the community go through AI scoring + 2 human reviewers + 7-day silent objection window before landing here withsource_tier=community-verified.
OS impact
Linux kernel Affected 3 releases
| Version | Status | Fixed in |
|---|---|---|
| 7.0 | Affected | — |
| 3.13 | Affected | — |
| — | Affected | 6.18.20 |
SUSE Affected 1 release
| Version | Status | Fixed in |
|---|---|---|
| — | Affected | — |
Debian Mixed 5 releases
| Version | Status | Fixed in |
|---|---|---|
| trixie | Fixed | 6.12.85-1 |
| sid | Fixed | 6.19.10-1 |
| forky | Fixed | 6.19.10-1 |
| bullseye | Affected | — |
| bookworm | Affected | — |
References
- https://www.suse.com/security/cve/CVE-2026-23444.html
- https://security-tracker.debian.org/tracker/CVE-2026-23444
- https://git.kernel.org/stable/c/06e769dddcbeb3baf2ce346273b53dd61fdbecf4
- https://git.kernel.org/stable/c/3b4d27acafaeab478fd24f79ad6e593a892828b9
- https://git.kernel.org/stable/c/50f1b690b4868923fbd242298def2fb88662f108
- https://git.kernel.org/stable/c/5ef8ca1c164786da24169af155c1ca1ff1353cf8
- https://git.kernel.org/stable/c/905ef207d5ed99ca64adfe39fba9ac46e434327a
- https://git.kernel.org/stable/c/9a779d1f480e83720b5384adf165604e7ee226bd
- https://git.kernel.org/stable/c/d5ad6ab61cbd89afdb60881f6274f74328af3ee9
- https://git.kernel.org/stable/c/f77b51bcee7be2bb686b5f7a2d4a1921e4bdb9f4
CWEs
CWE-401
Community-verified mitigations for this CVE will appear above when contributors publish them.
Verify integrity in audit chain (admin only). AS-IS.