CVE-2026-63821

What it actually does

Memory leaks of socket buffers (skbs) in rtw_usb_write_data() and of txcb structures plus aggregated skbs in rtw_usb_tx_agg_skb() when rtw_usb_write_port() fails to submit a URB; the completion callback that would free these objects is never invoked.

Why it matters to the business

Systems using the affected USB WiFi hardware may experience gradual memory exhaustion during device disconnects, reconnects, or under memory pressure, eventually leading to degraded performance or crashes in long-running wireless environments.

How an attack unfolds

An attacker with local or physical access can repeatedly trigger USB write failures (via device disconnect or by inducing ENOMEM) to leak kernel memory; because no remote code execution or privilege escalation path is present, the effect is limited to resource exhaustion rather than direct compromise.

How to fix it

Update the Linux kernel to a version containing the fix that checks the return value of rtw_usb_write_port() and explicitly frees the skb or purges the tx_ack_queue and txcb on failure; apply the vendor-supplied patch or backport for the rtw88 USB driver.

How to confirm the fix worked

Confirm the presence of the corrected return-value checks and explicit free paths in rtw_usb_write_data() and rtw_usb_tx_agg_skb(); test by forcing USB write failures and verifying that skbs and txcb objects are released rather than leaked.

Typical attack path

1. Gain access to a system with the vulnerable rtw88 USB WiFi driver loaded
2. Induce repeated USB submission failures (physical disconnect, power events, or memory pressure)
3. Observe progressive kernel memory depletion without corresponding frees
4. Trigger system instability or OOM conditions after sustained leakage

How to detect it

Review kernel logs for repeated rtw_usb_write_port failures during disconnect or memory-pressure events; correlate with rising slab or kmalloc memory usage that does not decrease after the triggering condition ends; no post-exploitation artifacts are expected because the issue is a leak rather than an active exploit.

What your security team should do

• Prioritize kernel updates on any systems using rtw88 USB WiFi adapters, especially in environments with frequent device attach/detach events
• Monitor memory usage trends on affected hosts until patches are deployed
• Consider disabling the rtw88 USB driver if the hardware is not required and no update path exists