VulnerabilityPublished 24 Jun 2026Updated 21 Oct 2026

CVE-2026-53113: Linux kernel · wifi: ath11k: fix memory leaks in beacon template setup

Affects Linux kernelSource CVE Database V5

Not known to be exploited · fixed in ff49eba595df500e4ddccc593088c8a4ab5f2c27 : update Linux kernel when convenient.

Data as of 26 Oct 2026, 17:16 UTC

Severity

Unrated

Rated by Threat Radar · No CVSS score from NVD or the CNA

EPSS: 0.1% chance of exploitation in 30 days – higher than 1% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
Patch: Available – fixed in ff49eba595df500e4ddccc593088c8a4ab5f2c27, 9478aa5b39e986d45fafe279c24d3546783c22b1, 7bedc489611f01634cec20f88f961a1f08e8d935 +2

Exploitation evidence

Disclosed: evidence found.
CVE published 24 Jun 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Upgrade to a fixed release listed under Affected software.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected ≥ 335a92765d308dfe22826f5562cd4b4389b45e71, < ff49eba595df500e4ddccc593088c8a4ab5f2c27	Fixed in ff49eba595df500e4ddccc593088c8a4ab5f2c27
LinuxLinux	Affected ≥ 335a92765d308dfe22826f5562cd4b4389b45e71, < 9478aa5b39e986d45fafe279c24d3546783c22b1	Fixed in 9478aa5b39e986d45fafe279c24d3546783c22b1
LinuxLinux	Affected ≥ 335a92765d308dfe22826f5562cd4b4389b45e71, < 7bedc489611f01634cec20f88f961a1f08e8d935	Fixed in 7bedc489611f01634cec20f88f961a1f08e8d935
LinuxLinux	Affected ≥ 335a92765d308dfe22826f5562cd4b4389b45e71, < 5fc3d921512d31839227a2d22a2990de02acefeb	Fixed in 5fc3d921512d31839227a2d22a2990de02acefeb
LinuxLinux	Affected ≥ 335a92765d308dfe22826f5562cd4b4389b45e71, < 5d63aa38d5ca85206d9699ffdd616b58780dba07	Fixed in 5d63aa38d5ca85206d9699ffdd616b58780dba07
LinuxLinux	Affected =6.5	Fixed in–

Description

In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: fix memory leaks in beacon template setup The functions ath11k_mac_setup_bcn_tmpl_ema() and ath11k_mac_setup_bcn_tmpl_mbssid() allocate memory for beacon templates but fail to free it when parameter setup returns an error. Since beacon templates must be released during normal execution, they must also be released in the error handling paths to prevent memory leaks. Fix this by using unified exit paths with proper cleanup in the respective error paths. Compile tested only. Issue found using a prototype static analysis tool and code review.

References

Community reviews

Loading reviews…