CVE-2026-53113

What it actually does

This is a Linux kernel memory leak in the ath11k Wi-Fi driver. During beacon template setup for EMA or MBSSID operation, the driver allocates beacon-template memory but, on certain error paths, fails to release it. Repeatedly triggering those error paths can consume kernel memory over time, potentially leading to degraded wireless functionality, kernel memory pressure, out-of-memory conditions, or system instability. Exploitation is most plausible on systems using Qualcomm ath11k-supported Wi-Fi hardware and normally requires the ability to change wireless/AP configuration or otherwise cause repeated beacon template setup failures.

Why it matters to the business

Affected systems may experience degraded Wi-Fi service, instability, or outages if kernel memory is gradually exhausted. The business risk is primarily availability-related rather than data theft or code execution. Because EPSS is very low, the issue is not known to be broadly exploited, is not in CISA KEV, and has no reported mature exploit, urgency is moderate unless the organization operates Linux systems with ath11k-based wireless hardware in access point, mesh, MBSSID, or managed Wi-Fi roles.

How an attack unfolds

An attacker first needs access to a system or management interface capable of altering Wi-Fi configuration on a Linux host using the ath11k driver. They then repeatedly cause beacon template setup to enter the vulnerable error paths, such as by cycling configurations involving EMA or MBSSID parameters that fail during setup. Each failed setup can leave allocated kernel memory unreleased. Over repeated attempts, leaked memory accumulates and can create kernel memory pressure. If sustained, this may degrade networking, trigger out-of-memory handling, kill processes, or destabilize the host. There is no indication from the provided data of active exploitation, ransomware use, or a public exploit.

How to fix it

Upgrade to a Linux kernel version or vendor kernel package that includes the ath11k fix for the beacon template memory leak. Because no exact fixed versions were provided, track the remediation through the relevant Linux distribution, appliance vendor, or kernel stable branch advisories for CVE-2026-53113 or the ath11k beacon template cleanup patch. Where immediate patching is not possible, reduce exposure by disabling unused ath11k wireless interfaces, avoiding AP/mesh/MBSSID/EMA configurations on vulnerable systems, restricting who can change wireless configuration, and limiting access to network management services that can reconfigure Wi-Fi.

How to confirm the fix worked

Confirm the running kernel or vendor package includes the ath11k fix by checking distribution security advisories, kernel changelogs, or package metadata. Verify that affected systems actually load ath11k modules by checking loaded modules and hardware inventory. After patching, reboot into the fixed kernel and confirm the active kernel version is the updated one. For functional validation, exercise representative Wi-Fi/AP configuration changes and monitor kernel logs and memory usage for repeated ath11k errors, kmemleak reports, or unexplained memory growth.

Typical attack path

1. Identify a Linux system using Qualcomm ath11k-supported Wi-Fi hardware.
2. Obtain local administrative privileges, CAP_NET_ADMIN-equivalent capability, or access to a Wi-Fi management component that can modify AP/beacon-related settings.
3. Configure or cycle wireless settings that exercise EMA or MBSSID beacon template setup.
4. Trigger setup failures repeatedly so the vulnerable error path leaks allocated beacon-template memory.
5. Continue the loop until kernel memory pressure causes Wi-Fi disruption, process termination, or system instability.

How to detect it

To assess possible prior exploitation or abuse, review kernel logs, system journals, and Wi-Fi management logs for repeated ath11k errors, beacon template setup failures, MBSSID or EMA configuration churn, unexplained wireless restarts, memory allocation failures, and OOM killer events. Useful sources include journalctl, dmesg, /var/log/kern.log, /var/log/messages, NetworkManager logs, hostapd logs, system management/audit logs for wireless configuration changes, and kernel memory diagnostics such as kmemleak where enabled. Look for patterns where ath11k errors and repeated AP/beacon reconfiguration precede sustained kernel memory growth, process kills, or device instability. Because this is a memory leak rather than a file-dropping or command-execution issue, durable forensic artifacts may be limited and there may be no attacker-specific indicators.

• ath11k
• ath11k_pci
• ath11k_ahb
• ath11k_mac_setup_bcn_tmpl_ema
• ath11k_mac_setup_bcn_tmpl_mbssid
• bcn_tmpl
• beacon template
• MBSSID
• EMA
• Out of memory
• Memory allocation failure
• oom-killer
• Killed process
• /sys/kernel/debug/kmemleak
• /var/log/kern.log
• /var/log/messages

What your security team should do

• Inventory Linux systems using ath11k-supported Qualcomm Wi-Fi hardware, especially devices operating as access points, mesh nodes, or managed wireless gateways.
• Prioritize patching systems where untrusted users or automation can change Wi-Fi/AP configuration.
• Apply the vendor kernel update containing the ath11k beacon template cleanup fix and reboot into the fixed kernel.
• If patching is delayed, disable unnecessary ath11k interfaces or AP/MBSSID/EMA features and restrict wireless configuration privileges.
• Monitor kernel logs for ath11k beacon-template errors, memory allocation failures, OOM killer activity, and repeated Wi-Fi reconfiguration events.
• Because EPSS is low and the issue is not KEV-listed, treat this as an availability-hardening update unless local conditions make wireless service critical or exposed to untrusted management access.