The vulnerability in the Linux kernel's mac80211 wifi component involves a memory leak in the ieee80211_register_hw() function. Specifically, if the kmemdup() call fails when copying supported band structures, the error handling path jumps to fail_rate, which skips the call to rate_control_deinitialize(). This omission causes the local->rate_ctrl resource to leak memory. The fix introduces a fail_band label that ensures the rate-control cleanup is performed before continuing with the remaining teardown steps. The issue was discovered using an experimental memory-management analysis tool during kernel development and confirmed to exist in version 7.1-rc7. Due to hardware constraints, no runtime tests were conducted. This vulnerability is tracked as CVE-2026-72004.

The impact of this vulnerability is a memory leak in the Linux kernel's wifi subsystem, which could lead to increased memory usage and potential resource exhaustion over time. There is no indication from the data that this leads to privilege escalation, code execution, or denial of service beyond the leak itself. No known exploits are reported in the wild.

A fix for this memory leak vulnerability has been implemented in the Linux kernel source by adding proper cleanup in the error path of ieee80211_register_hw(). Users and maintainers should apply the official kernel patches that include this fix once available. Since no runtime testing was performed, it is advisable to monitor the vendor's advisory for updated patches and testing results. Patch status is not yet confirmed in this data; check the official Linux kernel advisories or repositories for the current remediation status.