PT-2026-61137 · Linux · Linux Kernel

CVE-2026-63821 · Published 2026-07-19 · Updated 2026-07-19

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description In the rtw88 USB driver, memory leaks occur when the rtw usb write port() function fails to submit a USB Request Block (URB), such as during device disconnects or memory pressure (ENOMEM). Because the driver ignores the return value of rtw usb write port() within the rtw usb write data() and rtw usb tx agg skb() functions, the completion callback required to free resources is never executed. This leads to memory leaks of allocated socket buffers (skbs) in rtw usb write data(), as well as the transaction control block (txcb) and all aggregated skbs in rtw usb tx agg skb().

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2026-63821

Affected Products

Linux Kernel

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2026-63821 · Security Note
• https://git.kernel.org/stable/c/53fed4061a09755de99c89fdc7fae5b794da455f · Note
• https://git.kernel.org/stable/c/2b2060c2075a72bc2de43ce5e1b9347d6c5e27bb · Note
• https://git.kernel.org/stable/c/8206d173d18ef5a077423119f4e9a93cb3a6f4eb · Note
• https://git.kernel.org/stable/c/200d58c851b8f63f77a05570072dd20f79bc3681 · Note
• https://git.kernel.org/stable/c/6b964941bbfe6e0f18b1a5e008486dbb62df440a · Note
• https://twitter.com/VulmonFeeds/status/2078868979754397751 · Twitter Post