Memory leak in Linux kernel - CVE-2026-98351
Published: October 7, 2026
Vulnerability identifier: #VU153673
CSH Severity: Low
CVSS v4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-98351
CWE-ID: CWE-401
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to cause kernel memory leaks.
The vulnerability exists due to failure to free socket buffers in virt_wifi_start_xmit() when transmitting packets while the simulated link is disconnected. A local user can send packets through the disconnected simulated link to cause kernel memory leaks.
Affected software
Linux kernel
Debian Linux
linux (Debian package)
Debian Linux
linux (Debian package)
How to mitigate CVE-2026-98351
Install security update from vendor's repository.
Linux kernel - update to 7.0 rc3
linux (Debian package) - update to 6.12.113-1
linux (Debian package) - update to 6.12.113-1
External References
- https://git.kernel.org/stable/c/36727a702cf8e3399e3da60d0856378f6afcfb34
- https://git.kernel.org/stable/c/38d3a5df85345f158f78b478b265ca906224454e
- https://git.kernel.org/stable/c/46371442847a725cc0df3697fea2eba1dd54b82b
- https://git.kernel.org/stable/c/4f266738af45675faa0e8afee08c6e780afa8b06
- https://git.kernel.org/stable/c/56469996c10a0240653fc00576b4d33bdfb4cc51
- https://git.kernel.org/stable/c/d177eca79e1106834bc423d3969a4a2e3987996a
- https://git.kernel.org/stable/c/ee053ea35c759135460f03d1c574f4ed08de844a
- https://git.kernel.org/stable/c/f9edf7cf63b96d2b776fca8d258d3c5256e40c8e