CVE-2026-98351

What it actually does

Failure to free skb buffers in virt_wifi_start_xmit when the simulated link is disconnected causes repeated memory leaks as dev_hard_start_xmit treats NET_XMIT_DROP as ownership transfer.

Why it matters to the business

Systems relying on the virt_wifi driver for testing or simulation can experience gradual memory exhaustion, degrading performance or triggering out-of-memory conditions over time.

How an attack unfolds

An attacker or automated process repeatedly queues packets while the virt_wifi simulated link is down; each packet leaks its skb without being freed, accumulating kernel memory usage until resource pressure occurs.

How to fix it

Apply the upstream kernel patch that frees the skb before returning NET_XMIT_DROP in virt_wifi_start_xmit; rebuild and deploy the corrected kernel image.

How to confirm the fix worked

Confirm the patch is present by inspecting the virt_wifi_start_xmit function for an skb_free call prior to the NET_XMIT_DROP return; monitor kernel memory statistics during link-down traffic tests.

Typical attack path

1. Establish or simulate a virt_wifi interface
2. Bring the link down or trigger disconnection state
3. Generate or forward network traffic to the interface
4. Observe skb allocations without corresponding frees
5. Repeat to accelerate memory consumption

How to detect it

Monitor kernel slab or skb allocation counters while the virt_wifi interface is in a disconnected state; look for steadily increasing memory usage without corresponding packet transmission success.

What your security team should do

• Identify all systems using the virt_wifi module and schedule kernel updates
• Disable or remove virt_wifi from production kernels where possible
• Add memory usage monitoring for kernel skb allocations in affected environments
• Review kernel changelogs for the specific fix commit when updating