VulnerabilityPublished 24 Apr 2026Updated 6 Nov 2026

CVE-2026-31604: Linux kernel · wifi: rtw88: fix device leak on probe failure

Affects Linux kernelSource CVE Database V5

Compare

Not known to be exploited · fixed in f632987306bce9242cdfcf911ee0b2c9455e05a3 : update Linux kernel when convenient.

Data as of 6 Nov 2026, 16:04 UTC

Severity

Unrated

Rated by Threat Radar · No CVSS score from NVD or the CNA

Thin evidence

One scorer or none

Exploitation: No evidence of active exploitation and no public proof of concept
Automatable: Attackers cannot reliably automate steps 1–4 of the kill chain
Technical impact: Limited control over the software or limited information exposure

CISA SSVC assessment, 2026-11-06.

Patch

Available – fixed in f632987306bce9242cdfcf911ee0b2c9455e05a3, bbb15e71156cd9f5e1869eee7207a06ea8e96c39, af7307e96dad00bcc2675dac650d8558a52f2c6f +3

Exploitation evidence

Disclosed: evidence found.
CVE published 24 Apr 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponized: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 6 Nov 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponized: A Metasploit exploit module or Exploit-DB entry exists (Metasploit scanner modules do not count), or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Upgrade to a fixed release listed under Affected software.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected ≥ a82dfd33d1237f6c0fb8a7077022189d1fc7ec98, < f632987306bce9242cdfcf911ee0b2c9455e05a3	Fixed in f632987306bce9242cdfcf911ee0b2c9455e05a3
LinuxLinux	Affected ≥ a82dfd33d1237f6c0fb8a7077022189d1fc7ec98, < bbb15e71156cd9f5e1869eee7207a06ea8e96c39	Fixed in bbb15e71156cd9f5e1869eee7207a06ea8e96c39
LinuxLinux	Affected ≥ a82dfd33d1237f6c0fb8a7077022189d1fc7ec98, < af7307e96dad00bcc2675dac650d8558a52f2c6f	Fixed in af7307e96dad00bcc2675dac650d8558a52f2c6f
LinuxLinux	Affected ≥ a82dfd33d1237f6c0fb8a7077022189d1fc7ec98, < a4f4371d194dfa5473cc961f86194084b1b13a69	Fixed in a4f4371d194dfa5473cc961f86194084b1b13a69
LinuxLinux	Affected ≥ a82dfd33d1237f6c0fb8a7077022189d1fc7ec98, < 89a9c1bc7d797120bcc290864e0cb10a440a677f	Fixed in 89a9c1bc7d797120bcc290864e0cb10a440a677f
LinuxLinux	Affected ≥ a82dfd33d1237f6c0fb8a7077022189d1fc7ec98, < 25a827b7e1d5747a255bdc757f1d3e9e1e8a4e2a	Fixed in 25a827b7e1d5747a255bdc757f1d3e9e1e8a4e2a

Description

In the Linux kernel, the following vulnerability has been resolved: wifi: rtw88: fix device leak on probe failure Driver core holds a reference to the USB interface and its parent USB device while the interface is bound to a driver and there is no need to take additional references unless the structures are needed after disconnect. This driver takes a reference to the USB device during probe but does not to release it on all probe errors (e.g. when descriptor parsing fails). Drop the redundant device reference to fix the leak, reduce cargo culting, make it easier to spot drivers where an extra reference is needed, and reduce the risk of further memory leaks.

References

Community reviews

Loading reviews…