CVE-2026-31604
Estado: AnalizadaMedia (5.5)—
In the Linux kernel, the following vulnerability has been resolved:
wifi: rtw88: fix device leak on probe failure
Driver core holds a reference to the USB interface and its parent USB device while the interface is bound to a driver and there is no need to take additional references unless the structures are needed after disconnect.
This driver takes a reference to the USB device during probe but does not to release it on all probe errors (e.g. when descriptor parsing fails).
Drop the redundant device reference to fix the leak, reduce cargo culting, make it easier to spot drivers where an extra reference is needed, and reduce the risk of further memory leaks.
CVSS
- Versión: 3.1
- Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- Puntuación base: 5.5
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 0.16%
- Percentil entre todas las CVEs puntuadas: 5
- Fecha de la puntuación: 5/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (1)
CWE
- CWE-401
Referencias
- https://git.kernel.org/stable/c/25a827b7e1d5747a255bdc757f1d3e9e1e8a4e2a
- https://git.kernel.org/stable/c/89a9c1bc7d797120bcc290864e0cb10a440a677f
- https://git.kernel.org/stable/c/a4f4371d194dfa5473cc961f86194084b1b13a69
- https://git.kernel.org/stable/c/af7307e96dad00bcc2675dac650d8558a52f2c6f
- https://git.kernel.org/stable/c/bbb15e71156cd9f5e1869eee7207a06ea8e96c39
- https://git.kernel.org/stable/c/f632987306bce9242cdfcf911ee0b2c9455e05a3
JSON original (NVD)
Mostrar
{
"id": "CVE-2026-31604",
"cveTags": [],
"metrics": {
"cvssMetricV31": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 5.5,
"attackVector": "LOCAL",
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"integrityImpact": "NONE",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "LOW",
"confidentialityImpact": "NONE"
},
"impactScore": 3.6,
"exploitabilityScore": 1.8
}
]
},
"affected": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"affectedData": [
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "a82dfd33d1237f6c0fb8a7077022189d1fc7ec98",
"lessThan": "f632987306bce9242cdfcf911ee0b2c9455e05a3",
"versionType": "git"
},
{
"status": "affected",
"version": "a82dfd33d1237f6c0fb8a7077022189d1fc7ec98",
"lessThan": "a4f4371d194dfa5473cc961f86194084b1b13a69",
"versionType": "git"
},
{
"status": "affected",
"version": "a82dfd33d1237f6c0fb8a7077022189d1fc7ec98",
"lessThan": "89a9c1bc7d797120bcc290864e0cb10a440a677f",
"versionType": "git"
},
{
"status": "affected",
"version": "a82dfd33d1237f6c0fb8a7077022189d1fc7ec98",
"lessThan": "af7307e96dad00bcc2675dac650d8558a52f2c6f",
"versionType": "git"
},
{
"status": "affected",
"version": "a82dfd33d1237f6c0fb8a7077022189d1fc7ec98",
"lessThan": "25a827b7e1d5747a255bdc757f1d3e9e1e8a4e2a",
"versionType": "git"
},
{
"status": "affected",
"version": "a82dfd33d1237f6c0fb8a7077022189d1fc7ec98",
"lessThan": "bbb15e71156cd9f5e1869eee7207a06ea8e96c39",
"versionType": "git"
}
],
"programFiles": [
"drivers/net/wireless/realtek/rtw88/usb.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "6.2"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "6.2",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "6.6.136",
"versionType": "semver",
"lessThanOrEqual": "6.6.*"
},
{
"status": "unaffected",
"version": "6.12.83",
"versionType": "semver",
"lessThanOrEqual": "6.12.*"
},
{
"status": "unaffected",
"version": "6.18.24",
"versionType": "semver",
"lessThanOrEqual": "6.18.*"
},
{
"status": "unaffected",
"version": "6.19.14",
"versionType": "semver",
"lessThanOrEqual": "6.19.*"
},
{
"status": "unaffected",
"version": "7.0.1",
"versionType": "semver",
"lessThanOrEqual": "7.0.*"
},
{
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"drivers/net/wireless/realtek/rtw88/usb.c"
],
"defaultStatus": "affected"
}
]
}
],
"published": "2026-04-24T15:16:39.627",
"references": [
{
"url": "https://git.kernel.org/stable/c/25a827b7e1d5747a255bdc757f1d3e9e1e8a4e2a",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/89a9c1bc7d797120bcc290864e0cb10a440a677f",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/a4f4371d194dfa5473cc961f86194084b1b13a69",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/af7307e96dad00bcc2675dac650d8558a52f2c6f",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/bbb15e71156cd9f5e1869eee7207a06ea8e96c39",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/f632987306bce9242cdfcf911ee0b2c9455e05a3",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
],
"vulnStatus": "Analyzed",
"weaknesses": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "CWE-401"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: rtw88: fix device leak on probe failure\n\nDriver core holds a reference to the USB interface and its parent USB\ndevice while the interface is bound to a driver and there is no need to\ntake additional references unless the structures are needed after\ndisconnect.\n\nThis driver takes a reference to the USB device during probe but does\nnot to release it on all probe errors (e.g. when descriptor parsing\nfails).\n\nDrop the redundant device reference to fix the leak, reduce cargo\nculting, make it easier to spot drivers where an extra reference is\nneeded, and reduce the risk of further memory leaks."
}
],
"lastModified": "2026-06-17T10:34:04.353",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "0A0F1E9A-F127-4699-A014-9E08441C9A14",
"versionEndExcluding": "6.6.136",
"versionStartIncluding": "6.2"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "7F0AE5B5-23AC-4DCC-B37A-51CA1DAE7BA8",
"versionEndExcluding": "6.12.83",
"versionStartIncluding": "6.7"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "8126B8B8-6D0B-4443-86C1-672AEE893555",
"versionEndExcluding": "6.18.24",
"versionStartIncluding": "6.13"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D6A8A074-BBF4-4803-ABED-519A839435BB",
"versionEndExcluding": "6.19.14",
"versionStartIncluding": "6.19"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "9B5888AB-7403-4335-89E4-21CC0B48366A",
"versionEndExcluding": "7.0.1",
"versionStartIncluding": "7.0"
}
],
"operator": "OR"
}
]
}
],
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}