CVE-2026-23444

A flaw was found in the Linux kernel's mac80211 Wi-Fi subsystem. This vulnerability occurs because a specific error path within the ieee80211_tx_prepare_skb() function fails to properly release a network buffer, known as a socket buffer (skb). This inconsistency can lead to a double-free condition, where the same memory is freed multiple times. A local attacker could exploit this to cause memory corruption, potentially leading to a system crash (Denial of Service) or, in more severe scenarios, the execution of unauthorized code.

This is a wireless TX preparation path: incorrect skb lifetime affects core mac80211 and several drivers. Double-free and skb corruption are serious; worst-case impact beyond denial of service should not be ruled out without manual review. Triggers still require driving WiFi transmit from local context (not Internet-wide), but the stack is networking-adjacent and merits a stricter lens than a generic single-driver typo.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, prevent unnecessary wireless driver modules if not needed. See https://access.redhat.com/solutions/41278 for instructions.