{"id":"CVE-2026-72004","title":"wifi: mac80211: fix memory leak in ieee80211_register_hw()","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: fix memory leak in ieee80211_register_hw()\n\nIf kmemdup() fails while copying supported band structures, the error\npath jumps to fail_rate. This skips ra…","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= 09b4a4faf9d037990ac4f8110dd944b27b42d5df < f01eec75fd372961550b928902f3a2c11fca1daf","Linux >= 09b4a4faf9d037990ac4f8110dd944b27b42d5df < 3d8b9b290421c3cd505fcd2f551f143f8142786a","Linux >= 09b4a4faf9d037990ac4f8110dd944b27b42d5df < 08b71bd92317f99642b842cfc0d30200868162fc","Linux >= 09b4a4faf9d037990ac4f8110dd944b27b42d5df < a02b52fe54f7b5107aefa1ce28c2f69749c57616","Linux >= 09b4a4faf9d037990ac4f8110dd944b27b42d5df < 45e9ac538cdff7bce656d731114a64eda85af0d7","Linux >= 09b4a4faf9d037990ac4f8110dd944b27b42d5df < bdc0b8bfdc142439d6708b072e8159eb515ee7b0","Linux >= 09b4a4faf9d037990ac4f8110dd944b27b42d5df < a7584f261e64fe14e45bdf70f343e16c1ee3a037","Linux >= 09b4a4faf9d037990ac4f8110dd944b27b42d5df < 95fc02722edde02946d0d475221f2b2054d3d8ba","Linux 4.20"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-11-06T16:50:16.811544Z"},"published":"2026-08-15","updated":"2026-11-06","sourceUpdated":"2026-11-06T16:55:17.970Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-72004","references":[{"url":"https://git.kernel.org/stable/c/f01eec75fd372961550b928902f3a2c11fca1daf"},{"url":"https://git.kernel.org/stable/c/3d8b9b290421c3cd505fcd2f551f143f8142786a"},{"url":"https://git.kernel.org/stable/c/08b71bd92317f99642b842cfc0d30200868162fc"},{"url":"https://git.kernel.org/stable/c/a02b52fe54f7b5107aefa1ce28c2f69749c57616"},{"url":"https://git.kernel.org/stable/c/45e9ac538cdff7bce656d731114a64eda85af0d7"},{"url":"https://git.kernel.org/stable/c/bdc0b8bfdc142439d6708b072e8159eb515ee7b0"},{"url":"https://git.kernel.org/stable/c/a7584f261e64fe14e45bdf70f343e16c1ee3a037"},{"url":"https://git.kernel.org/stable/c/95fc02722edde02946d0d475221f2b2054d3d8ba"}],"tags":["cve.org"],"epss":0.0022,"epssPercentile":0.12546,"ingestedAt":"2026-11-06T18:00:12.600Z","slug":"CVE-2026-72004","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: fix memory leak in ieee80211_register_hw()\n\nIf kmemdup() fails while copying supported band structures, the error\npath jumps to fail_rate. This skips rate_control_deinitialize() and\nleaks the initialized local->rate_ctrl.\n\nFix this by adding a fail_band label that shares the rate-control cleanup\npath before falling through to the remaining teardown.\n\nThe bug was first flagged by an experimental analysis tool we are\ndeveloping for kernel memory-management bugs while analyzing\nv6.13-rc1. The tool is still under development and is not yet publicly\navailable. Manual inspection confirms that the bug is still present in\nv7.1-rc7.\n\nAn x86_64 allyesconfig build showed no new warnings. As we do not have a\nsuitable mac80211 device/driver combination to test with, no runtime\ntesting was able to be performed.\n\n## Affected\n\n- `Linux >= 09b4a4faf9d037990ac4f8110dd944b27b42d5df < f01eec75fd372961550b928902f3a2c11fca1daf`\n- `Linux >= 09b4a4faf9d037990ac4f8110dd944b27b42d5df < 3d8b9b290421c3cd505fcd2f551f143f8142786a`\n- `Linux >= 09b4a4faf9d037990ac4f8110dd944b27b42d5df < 08b71bd92317f99642b842cfc0d30200868162fc`\n- `Linux >= 09b4a4faf9d037990ac4f8110dd944b27b42d5df < a02b52fe54f7b5107aefa1ce28c2f69749c57616`\n- `Linux >= 09b4a4faf9d037990ac4f8110dd944b27b42d5df < 45e9ac538cdff7bce656d731114a64eda85af0d7`\n- `Linux >= 09b4a4faf9d037990ac4f8110dd944b27b42d5df < bdc0b8bfdc142439d6708b072e8159eb515ee7b0`\n- `Linux >= 09b4a4faf9d037990ac4f8110dd944b27b42d5df < a7584f261e64fe14e45bdf70f343e16c1ee3a037`\n- `Linux >= 09b4a4faf9d037990ac4f8110dd944b27b42d5df < 95fc02722edde02946d0d475221f2b2054d3d8ba`\n- `Linux 4.20`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}