---
id: CVE-2026-72004
title: 'wifi: mac80211: fix memory leak in ieee80211_register_hw()'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  wifi: mac80211: fix memory leak in ieee80211_register_hw()

  If kmemdup() fails while copying supported band structures, the error
  path jumps to fail_rate. This skips ra…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 09b4a4faf9d037990ac4f8110dd944b27b42d5df <
    f01eec75fd372961550b928902f3a2c11fca1daf
  - >-
    Linux >= 09b4a4faf9d037990ac4f8110dd944b27b42d5df <
    3d8b9b290421c3cd505fcd2f551f143f8142786a
  - >-
    Linux >= 09b4a4faf9d037990ac4f8110dd944b27b42d5df <
    08b71bd92317f99642b842cfc0d30200868162fc
  - >-
    Linux >= 09b4a4faf9d037990ac4f8110dd944b27b42d5df <
    a02b52fe54f7b5107aefa1ce28c2f69749c57616
  - >-
    Linux >= 09b4a4faf9d037990ac4f8110dd944b27b42d5df <
    45e9ac538cdff7bce656d731114a64eda85af0d7
  - >-
    Linux >= 09b4a4faf9d037990ac4f8110dd944b27b42d5df <
    bdc0b8bfdc142439d6708b072e8159eb515ee7b0
  - >-
    Linux >= 09b4a4faf9d037990ac4f8110dd944b27b42d5df <
    a7584f261e64fe14e45bdf70f343e16c1ee3a037
  - >-
    Linux >= 09b4a4faf9d037990ac4f8110dd944b27b42d5df <
    95fc02722edde02946d0d475221f2b2054d3d8ba
  - Linux 4.20
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-06T16:50:16.811544Z'
published: '2026-08-15'
updated: '2026-11-06'
sourceUpdated: '2026-11-06T16:55:17.970Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-72004'
references:
  - url: 'https://git.kernel.org/stable/c/f01eec75fd372961550b928902f3a2c11fca1daf'
  - url: 'https://git.kernel.org/stable/c/3d8b9b290421c3cd505fcd2f551f143f8142786a'
  - url: 'https://git.kernel.org/stable/c/08b71bd92317f99642b842cfc0d30200868162fc'
  - url: 'https://git.kernel.org/stable/c/a02b52fe54f7b5107aefa1ce28c2f69749c57616'
  - url: 'https://git.kernel.org/stable/c/45e9ac538cdff7bce656d731114a64eda85af0d7'
  - url: 'https://git.kernel.org/stable/c/bdc0b8bfdc142439d6708b072e8159eb515ee7b0'
  - url: 'https://git.kernel.org/stable/c/a7584f261e64fe14e45bdf70f343e16c1ee3a037'
  - url: 'https://git.kernel.org/stable/c/95fc02722edde02946d0d475221f2b2054d3d8ba'
tags:
  - cve.org
epss: 0.0022
epssPercentile: 0.12546
ingestedAt: '2026-11-06T18:00:12.600Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

wifi: mac80211: fix memory leak in ieee80211_register_hw()

If kmemdup() fails while copying supported band structures, the error
path jumps to fail_rate. This skips rate_control_deinitialize() and
leaks the initialized local->rate_ctrl.

Fix this by adding a fail_band label that shares the rate-control cleanup
path before falling through to the remaining teardown.

The bug was first flagged by an experimental analysis tool we are
developing for kernel memory-management bugs while analyzing
v6.13-rc1. The tool is still under development and is not yet publicly
available. Manual inspection confirms that the bug is still present in
v7.1-rc7.

An x86_64 allyesconfig build showed no new warnings. As we do not have a
suitable mac80211 device/driver combination to test with, no runtime
testing was able to be performed.

## Affected

- `Linux >= 09b4a4faf9d037990ac4f8110dd944b27b42d5df < f01eec75fd372961550b928902f3a2c11fca1daf`
- `Linux >= 09b4a4faf9d037990ac4f8110dd944b27b42d5df < 3d8b9b290421c3cd505fcd2f551f143f8142786a`
- `Linux >= 09b4a4faf9d037990ac4f8110dd944b27b42d5df < 08b71bd92317f99642b842cfc0d30200868162fc`
- `Linux >= 09b4a4faf9d037990ac4f8110dd944b27b42d5df < a02b52fe54f7b5107aefa1ce28c2f69749c57616`
- `Linux >= 09b4a4faf9d037990ac4f8110dd944b27b42d5df < 45e9ac538cdff7bce656d731114a64eda85af0d7`
- `Linux >= 09b4a4faf9d037990ac4f8110dd944b27b42d5df < bdc0b8bfdc142439d6708b072e8159eb515ee7b0`
- `Linux >= 09b4a4faf9d037990ac4f8110dd944b27b42d5df < a7584f261e64fe14e45bdf70f343e16c1ee3a037`
- `Linux >= 09b4a4faf9d037990ac4f8110dd944b27b42d5df < 95fc02722edde02946d0d475221f2b2054d3d8ba`
- `Linux 4.20`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.