{
  "threat_severity" : "Moderate",
  "public_date" : "2026-04-03T00:00:00Z",
  "bugzilla" : {
    "description" : "kernel: wifi: mac80211: always free skb on ieee80211_tx_prepare_skb() failure",
    "id" : "2454876",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2454876"
  },
  "cvss3" : {
    "cvss3_base_score" : "5.5",
    "cvss3_scoring_vector" : "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
    "status" : "draft"
  },
  "cwe" : "CWE-1341",
  "details" : [ "In the Linux kernel, the following vulnerability has been resolved:\nwifi: mac80211: always free skb on ieee80211_tx_prepare_skb() failure\nieee80211_tx_prepare_skb() has three error paths, but only two of them\nfree the skb. The first error path (ieee80211_tx_prepare() returning\nTX_DROP) does not free it, while invoke_tx_handlers() failure and the\nfragmentation check both do.\nAdd kfree_skb() to the first error path so all three are consistent,\nand remove the now-redundant frees in callers (ath9k, mt76,\nmac80211_hwsim) to avoid double-free.\nDocument the skb ownership guarantee in the function's kdoc.", "A flaw was found in the Linux kernel's mac80211 Wi-Fi subsystem. This vulnerability occurs because a specific error path within the `ieee80211_tx_prepare_skb()` function fails to properly release a network buffer, known as a socket buffer (skb). This inconsistency can lead to a double-free condition, where the same memory is freed multiple times. A local attacker could exploit this to cause memory corruption, potentially leading to a system crash (Denial of Service) or, in more severe scenarios, the execution of unauthorized code." ],
  "statement" : "This is a wireless TX preparation path: incorrect skb lifetime affects core mac80211 and several drivers. Double-free and skb corruption are serious; worst-case impact beyond denial of service should not be ruled out without manual review. Triggers still require driving WiFi transmit from local context (not Internet-wide), but the stack is networking-adjacent and merits a stricter lens than a generic single-driver typo.",
  "package_state" : [ {
    "product_name" : "Red Hat Enterprise Linux 10",
    "fix_state" : "Fix deferred",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:10"
  }, {
    "product_name" : "Red Hat Enterprise Linux 6",
    "fix_state" : "Out of support scope",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:6"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7",
    "fix_state" : "Not affected",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7",
    "fix_state" : "Not affected",
    "package_name" : "kernel-rt",
    "cpe" : "cpe:/o:redhat:enterprise_linux:7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "fix_state" : "Fix deferred",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "fix_state" : "Fix deferred",
    "package_name" : "kernel-rt",
    "cpe" : "cpe:/o:redhat:enterprise_linux:8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "fix_state" : "Fix deferred",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:9"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "fix_state" : "Fix deferred",
    "package_name" : "kernel-rt",
    "cpe" : "cpe:/o:redhat:enterprise_linux:9"
  } ],
  "references" : [ "https://www.cve.org/CVERecord?id=CVE-2026-23444\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-23444\nhttps://lore.kernel.org/linux-cve-announce/2026040314-CVE-2026-23444-8169@gregkh/T" ],
  "name" : "CVE-2026-23444",
  "mitigation" : {
    "value" : "To mitigate this issue, prevent unnecessary wireless driver modules if not needed. See https://access.redhat.com/solutions/41278 for instructions.",
    "lang" : "en:us"
  },
  "csaw" : false
}