UBUNTU-CVE-2026-63821: Medium severity ubuntu/linux-hwe-edge vulnerability

Q: Which systems are realistically exposed to this issue?

Systems using the rtw88 USB Wi-Fi driver are affected when USB transmit requests cannot be submitted. The affected Ubuntu kernel package families listed are linux-riscv, linux-realtime, linux-azure, linux-gcp, linux-azure-fde, linux-gke, linux-hwe-edge, and linux-gkeop.

Q: What conditions trigger the memory leaks?

The leaks occur when rtw_usb_write_port() fails to submit a USB Request Block, such as during USB device disconnect or reconnect events or under memory-pressure conditions that produce ENOMEM. A successful submission does not trigger this failure path.

Q: What is the operational impact of exploitation or occurrence?

Failed USB write submissions can leave an allocated socket buffer unreleased in one transmit path. In aggregated transmit handling, they can leave the transaction control block and all aggregated socket buffers unreleased, causing memory consumption to grow.

Q: What can be done if an updated kernel cannot be deployed immediately?

The provided information identifies device disconnect/reconnect events and memory pressure as observed trigger conditions. Reducing those conditions may reduce exposure to the failure path, but the described remediation is to handle failed USB write submissions by freeing the affected buffers and control block.

Published Jul 19, 2026

Updated

In the Linux kernel, the following vulnerability has been resolved: wifi: rtw88: usb: fix memory leaks on USB write failures When rtwusbwriteport() fails to submit a USB Request Block (URB) (e.g., due to device disconnect or ENOMEM), the completion callback is never executed. Currently, the driver ignores the return value of rtwusbwriteport() in rtwusbwritedata() and rtwusbtxaggskb(). Because these functions rely on the completion callback to free the socket buffers (skbs) and the transaction control block (txcb), a submission failure results in: 1. A memory leak of the allocated skb in rtwusbwritedata(). 2. A memory leak of the txcb structure and all aggregated skbs in rtwusbtxaggskb(). Fix this by checking the return value of rtwusbwriteport(). If it fails, explicitly free the skb in rtwusbwritedata(), and properly purge the txackqueue and free the txcb in rtwusbtxaggskb(). The issue was discovered in practice during device disconnect/reconnect scenarios and memory pressure conditions. Tested by verifying normal TX operation continues after the fix without regressions.

Affected Software

161 affected componentsFixes available

ubuntu/linux-hwe-edge*

ubuntu/linux-aws-5.0*

ubuntu/linux-aws-5.3*

ubuntu/linux-azure*

ubuntu/linux-azure-5.3*

ubuntu/linux-azure-edge*

ubuntu/linux-gcp*

ubuntu/linux-gcp-5.3*

ubuntu/linux-gke-4.15*

ubuntu/linux-gke-5.4*

ubuntu/linux-gkeop-5.4*

ubuntu/linux-hwe*

ubuntu/linux-hwe-edge*

ubuntu/linux-oem*

ubuntu/linux-oracle-5.0*

ubuntu/linux-oracle-5.3*

ubuntu/linux-aws-5.11*

ubuntu/linux-aws-5.13*

ubuntu/linux-aws-5.8*

ubuntu/linux-azure-5.11*

ubuntu/linux-azure-5.13*

ubuntu/linux-azure-5.8*

ubuntu/linux-azure-fde*

ubuntu/linux-gcp-5.11*

ubuntu/linux-gcp-5.13*

ubuntu/linux-gcp-5.8*

ubuntu/linux-gke*

ubuntu/linux-gke-5.15*

ubuntu/linux-gkeop*

ubuntu/linux-gkeop-5.15*

ubuntu/linux-hwe-5.11*

ubuntu/linux-hwe-5.13*

ubuntu/linux-hwe-5.8*

ubuntu/linux-intel-5.13*

ubuntu/linux-oem-5.10*

ubuntu/linux-oem-5.13*

ubuntu/linux-oem-5.6*

ubuntu/linux-oracle-5.11*

ubuntu/linux-oracle-5.13*

ubuntu/linux-oracle-5.8*

ubuntu/linux-raspi2*

ubuntu/linux-riscv*

ubuntu/linux-riscv-5.11*

ubuntu/linux-riscv-5.8*

ubuntu/linux-allwinner-5.19*

ubuntu/linux-aws-5.19*

ubuntu/linux-aws-6.2*

ubuntu/linux-aws-6.5*

ubuntu/linux-aws-6.8*

ubuntu/linux-azure-5.19*

ubuntu/linux-azure-6.2*

ubuntu/linux-azure-6.5*

ubuntu/linux-azure-6.8*

ubuntu/linux-azure-fde-5.19*

ubuntu/linux-azure-fde-6.2*

ubuntu/linux-azure-fde-6.8*

ubuntu/linux-gcp-5.19*

ubuntu/linux-gcp-6.2*

ubuntu/linux-gcp-6.5*

ubuntu/linux-gcp-6.8*

ubuntu/linux-hwe-5.19*

ubuntu/linux-hwe-6.2*

ubuntu/linux-hwe-6.5*

ubuntu/linux-ibm-6.8*

ubuntu/linux-intel-iot-realtime*

ubuntu/linux-lowlatency-hwe-5.19*

ubuntu/linux-lowlatency-hwe-6.2*

ubuntu/linux-lowlatency-hwe-6.5*

ubuntu/linux-lowlatency-hwe-6.8*

ubuntu/linux-nvidia-6.2*

ubuntu/linux-nvidia-6.5*

ubuntu/linux-nvidia-6.8*

ubuntu/linux-oem-5.17*

ubuntu/linux-oem-6.0*

ubuntu/linux-oem-6.1*

ubuntu/linux-oem-6.5*

ubuntu/linux-oracle-6.5*

ubuntu/linux-oracle-6.8*

ubuntu/linux-realtime*

ubuntu/linux-riscv*

ubuntu/linux-riscv-5.19*

ubuntu/linux-riscv-6.5*

ubuntu/linux-riscv-6.8*

ubuntu/linux-starfive-5.19*

ubuntu/linux-starfive-6.2*

ubuntu/linux-starfive-6.5*

ubuntu/linux-realtime-6.8*

ubuntu/linux<6.8.0-147.147

6.8.0-147.147

ubuntu/linux-aws<6.8.0-1067.70

6.8.0-1067.70

ubuntu/linux-aws-6.14*

ubuntu/linux-aws-6.17*

ubuntu/linux-aws-7.0<7.0.0-1012.12~24.04.1

7.0.0-1012.12~24.04.1

ubuntu/linux-azure<6.8.0-1071.79

6.8.0-1071.79

ubuntu/linux-azure-6.11*

ubuntu/linux-azure-6.14*

ubuntu/linux-azure-6.17*

ubuntu/linux-azure-7.0<7.0.0-1014.14~24.04.1

7.0.0-1014.14~24.04.1

ubuntu/linux-azure-fde<6.8.0-1069.76

6.8.0-1069.76

ubuntu/linux-azure-fde-6.14*

ubuntu/linux-azure-fde-6.17*

ubuntu/linux-azure-fde-7.0<7.0.0-1013.13~24.04.1

7.0.0-1013.13~24.04.1

ubuntu/linux-azure-nvidia*

ubuntu/linux-azure-nvidia-6.14*

ubuntu/linux-gcp<6.8.0-1071.79

6.8.0-1071.79

ubuntu/linux-gcp-6.11*

ubuntu/linux-gcp-6.14*

ubuntu/linux-gcp-7.0<7.0.0-1011.11~24.04.1

7.0.0-1011.11~24.04.1

ubuntu/linux-gke<6.8.0-1066.74

6.8.0-1066.74

ubuntu/linux-gkeop<6.8.0-1052.56

6.8.0-1052.56

ubuntu/linux-hwe-6.11*

ubuntu/linux-hwe-6.14*

ubuntu/linux-hwe-6.17*

ubuntu/linux-hwe-7.0<7.0.0-31.31~24.04.1

7.0.0-31.31~24.04.1

ubuntu/linux-ibm<6.8.0-1067.68

6.8.0-1067.68

ubuntu/linux-lowlatency<6.8.0-147.147.1

6.8.0-147.147.1

ubuntu/linux-lowlatency-hwe-6.11*

ubuntu/linux-nvidia*

ubuntu/linux-nvidia-6.11*

ubuntu/linux-nvidia-6.17*

ubuntu/linux-nvidia-7.0<7.0.0-1018.18~24.04.1

7.0.0-1018.18~24.04.1

ubuntu/linux-nvidia-lowlatency*

ubuntu/linux-nvidia-tegra*

ubuntu/linux-oem-6.11*

ubuntu/linux-oem-6.14*

ubuntu/linux-oem-6.17*

ubuntu/linux-oem-6.8*

ubuntu/linux-oracle<6.8.0-1064.67

6.8.0-1064.67

ubuntu/linux-oracle-6.14*

ubuntu/linux-oracle-6.17*

ubuntu/linux-oracle-7.0<7.0.0-1011.11~24.04.1

7.0.0-1011.11~24.04.1

ubuntu/linux-raspi*

ubuntu/linux-raspi-realtime*

ubuntu/linux-realtime*

ubuntu/linux-riscv*

ubuntu/linux-riscv-6.14*

ubuntu/linux-riscv-6.17*

ubuntu/linux-riscv-7.0<7.0.0-31.31.1~24.04.1

7.0.0-31.31.1~24.04.1

ubuntu/linux-xilinx*

ubuntu/linux-bluefield<6.8.0-1033.38

6.8.0-1033.38

ubuntu/linux-raspi-realtime*

ubuntu/linux-realtime<6.8.1-1062.63

6.8.1-1062.63

ubuntu/linux-realtime-6.14*

ubuntu/linux-realtime-6.17*

ubuntu/linux-aws-fips<6.8.0-1067.70+fips1

6.8.0-1067.70+fips1

ubuntu/linux-azure-fips<6.8.0-1071.79+fips1

6.8.0-1071.79+fips1

ubuntu/linux-fips<6.8.0-147.147+fips1

6.8.0-147.147+fips1

ubuntu/linux-gcp-fips<6.8.0-1071.79+fips1

6.8.0-1071.79+fips1

ubuntu/linux<7.0.0-31.31

7.0.0-31.31

ubuntu/linux-aws<7.0.0-1012.12

7.0.0-1012.12

ubuntu/linux-azure<7.0.0-1014.14

7.0.0-1014.14

ubuntu/linux-azure-fde<7.0.0-1013.13

7.0.0-1013.13

ubuntu/linux-gcp<7.0.0-1011.11

7.0.0-1011.11

ubuntu/linux-gke<7.0.0-1006.7

7.0.0-1006.7

ubuntu/linux-ibm<7.0.0-1013.13

7.0.0-1013.13

ubuntu/linux-nvidia<7.0.0-1018.18

7.0.0-1018.18

ubuntu/linux-nvidia-bos<7.0.0-2018.18

7.0.0-2018.18

ubuntu/linux-oem-7.0<7.0.0-1013.13

7.0.0-1013.13

ubuntu/linux-oracle<7.0.0-1011.11

7.0.0-1011.11

ubuntu/linux-raspi<7.0.0-1019.19

7.0.0-1019.19

ubuntu/linux-realtime<7.0.0-31.31.1

7.0.0-31.31.1

ubuntu/linux-riscv<7.0.0-31.31.1

7.0.0-31.31.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade ubuntu/linux to a version that resolves this vulnerability.
Fixed in 6.8.0-147.147
Upgrade
Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.
Fixed in 6.8.0-1067.70
Upgrade
Upgrade ubuntu/linux-aws-7.0 to a version that resolves this vulnerability.
Fixed in 7.0.0-1012.12~24.04.1
Upgrade
Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.
Fixed in 6.8.0-1071.79
Upgrade
Upgrade ubuntu/linux-azure-7.0 to a version that resolves this vulnerability.
Fixed in 7.0.0-1014.14~24.04.1
Upgrade
Upgrade ubuntu/linux-azure-fde to a version that resolves this vulnerability.
Fixed in 6.8.0-1069.76
Upgrade
Upgrade ubuntu/linux-azure-fde-7.0 to a version that resolves this vulnerability.
Fixed in 7.0.0-1013.13~24.04.1
Upgrade
Upgrade ubuntu/linux-gcp to a version that resolves this vulnerability.
Fixed in 6.8.0-1071.79
Upgrade
Upgrade ubuntu/linux-gcp-7.0 to a version that resolves this vulnerability.
Fixed in 7.0.0-1011.11~24.04.1
Upgrade
Upgrade ubuntu/linux-gke to a version that resolves this vulnerability.
Fixed in 6.8.0-1066.74
Upgrade
Upgrade ubuntu/linux-gkeop to a version that resolves this vulnerability.
Fixed in 6.8.0-1052.56
Upgrade
Upgrade ubuntu/linux-hwe-7.0 to a version that resolves this vulnerability.
Fixed in 7.0.0-31.31~24.04.1
Upgrade
Upgrade ubuntu/linux-ibm to a version that resolves this vulnerability.
Fixed in 6.8.0-1067.68
Upgrade
Upgrade ubuntu/linux-lowlatency to a version that resolves this vulnerability.
Fixed in 6.8.0-147.147.1
Upgrade
Upgrade ubuntu/linux-nvidia-7.0 to a version that resolves this vulnerability.
Fixed in 7.0.0-1018.18~24.04.1
Upgrade
Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.
Fixed in 6.8.0-1064.67
Upgrade
Upgrade ubuntu/linux-oracle-7.0 to a version that resolves this vulnerability.
Fixed in 7.0.0-1011.11~24.04.1
Upgrade
Upgrade ubuntu/linux-riscv-7.0 to a version that resolves this vulnerability.
Fixed in 7.0.0-31.31.1~24.04.1
Upgrade
Upgrade ubuntu/linux-bluefield to a version that resolves this vulnerability.
Fixed in 6.8.0-1033.38
Upgrade
Upgrade ubuntu/linux-realtime to a version that resolves this vulnerability.
Fixed in 6.8.1-1062.63
Upgrade
Upgrade ubuntu/linux-aws-fips to a version that resolves this vulnerability.
Fixed in 6.8.0-1067.70+fips1
Upgrade
Upgrade ubuntu/linux-azure-fips to a version that resolves this vulnerability.
Fixed in 6.8.0-1071.79+fips1
Upgrade
Upgrade ubuntu/linux-fips to a version that resolves this vulnerability.
Fixed in 6.8.0-147.147+fips1
Upgrade
Upgrade ubuntu/linux-gcp-fips to a version that resolves this vulnerability.
Fixed in 6.8.0-1071.79+fips1
Upgrade
Upgrade ubuntu/linux to a version that resolves this vulnerability.
Fixed in 7.0.0-31.31
Upgrade
Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.
Fixed in 7.0.0-1012.12
Upgrade
Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.
Fixed in 7.0.0-1014.14
Upgrade
Upgrade ubuntu/linux-azure-fde to a version that resolves this vulnerability.
Fixed in 7.0.0-1013.13
Upgrade
Upgrade ubuntu/linux-gcp to a version that resolves this vulnerability.
Fixed in 7.0.0-1011.11
Upgrade
Upgrade ubuntu/linux-gke to a version that resolves this vulnerability.
Fixed in 7.0.0-1006.7
Upgrade
Upgrade ubuntu/linux-ibm to a version that resolves this vulnerability.
Fixed in 7.0.0-1013.13
Upgrade
Upgrade ubuntu/linux-nvidia to a version that resolves this vulnerability.
Fixed in 7.0.0-1018.18
Upgrade
Upgrade ubuntu/linux-nvidia-bos to a version that resolves this vulnerability.
Fixed in 7.0.0-2018.18
Upgrade
Upgrade ubuntu/linux-oem-7.0 to a version that resolves this vulnerability.
Fixed in 7.0.0-1013.13
Upgrade
Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.
Fixed in 7.0.0-1011.11
Upgrade
Upgrade ubuntu/linux-raspi to a version that resolves this vulnerability.
Fixed in 7.0.0-1019.19
Upgrade
Upgrade ubuntu/linux-realtime to a version that resolves this vulnerability.
Fixed in 7.0.0-31.31.1
Upgrade
Upgrade ubuntu/linux-riscv to a version that resolves this vulnerability.
Fixed in 7.0.0-31.31.1

Event History

Jul 19, 2026

CVE Published

via OSV·12:16 PM

Data Sourced

via OSV·12:16 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which systems are realistically exposed to this issue?

Systems using the rtw88 USB Wi-Fi driver are affected when USB transmit requests cannot be submitted. The affected Ubuntu kernel package families listed are linux-riscv, linux-realtime, linux-azure, linux-gcp, linux-azure-fde, linux-gke, linux-hwe-edge, and linux-gkeop.

What conditions trigger the memory leaks?

The leaks occur when rtw_usb_write_port() fails to submit a USB Request Block, such as during USB device disconnect or reconnect events or under memory-pressure conditions that produce ENOMEM. A successful submission does not trigger this failure path.

What is the operational impact of exploitation or occurrence?

Failed USB write submissions can leave an allocated socket buffer unreleased in one transmit path. In aggregated transmit handling, they can leave the transaction control block and all aggregated socket buffers unreleased, causing memory consumption to grow.

What can be done if an updated kernel cannot be deployed immediately?

The provided information identifies device disconnect/reconnect events and memory pressure as observed trigger conditions. Reducing those conditions may reduce exposure to the failure path, but the described remediation is to handle failed USB write submissions by freeing the affected buffers and control block.

UBUNTU-CVE-2026-63821: Medium severity ubuntu/linux-hwe-edge vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Which systems are realistically exposed to this issue?

What conditions trigger the memory leaks?

What is the operational impact of exploitation or occurrence?

What can be done if an updated kernel cannot be deployed immediately?

Company

Resources

Contact