CVE-2024-26896 in Linux
Summary
by MITRE • 04/17/2024
In the Linux kernel, the following vulnerability has been resolved:
wifi: wfx: fix memory leak when starting AP
Kmemleak reported this error:
unreferenced object 0xd73d1180 (size 184): comm "wpa_supplicant", pid 1559, jiffies 13006305 (age 964.245s) hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00 00 00 00 00 00 00 00 1e 00 01 00 00 00 00 00 ................ backtrace: [] kmem_cache_alloc+0x20c/0x5ac
[] __alloc_skb+0x144/0x170
[] __netdev_alloc_skb+0x50/0x180
[] __ieee80211_beacon_get+0x290/0x4d4 [mac80211]
[] ieee80211_beacon_get_tim+0x54/0x18c [mac80211]
[] wfx_start_ap+0xc8/0x234 [wfx]
[] ieee80211_start_ap+0x404/0x6b4 [mac80211]
[] nl80211_start_ap+0x76c/0x9e0 [cfg80211]
[] genl_rcv_msg+0x198/0x378
[] netlink_rcv_skb+0xd0/0x130
[] genl_rcv+0x34/0x44
[] netlink_unicast+0x1b4/0x258
[] netlink_sendmsg+0x1e8/0x428
[] ____sys_sendmsg+0x1e0/0x274
[] ___sys_sendmsg+0x80/0xb4
[] __sys_sendmsg+0x64/0xa8
unreferenced object 0xce087000 (size 1024): comm "wpa_supplicant", pid 1559, jiffies 13006305 (age 964.246s) hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 10 00 07 40 00 00 00 00 00 00 00 00 00 00 00 00 ...@............ backtrace: [] __kmalloc_track_caller+0x230/0x600
[] kmalloc_reserve.constprop.0+0x30/0x74
[] __alloc_skb+0xa0/0x170
[] __netdev_alloc_skb+0x50/0x180
[] __ieee80211_beacon_get+0x290/0x4d4 [mac80211]
[] ieee80211_beacon_get_tim+0x54/0x18c [mac80211]
[] wfx_start_ap+0xc8/0x234 [wfx]
[] ieee80211_start_ap+0x404/0x6b4 [mac80211]
[] nl80211_start_ap+0x76c/0x9e0 [cfg80211]
[] genl_rcv_msg+0x198/0x378
[] netlink_rcv_skb+0xd0/0x130
[] genl_rcv+0x34/0x44
[] netlink_unicast+0x1b4/0x258
[] netlink_sendmsg+0x1e8/0x428
[] ____sys_sendmsg+0x1e0/0x274
[] ___sys_sendmsg+0x80/0xb4
However, since the kernel is build optimized, it seems the stack is not accurate. It appears the issue is related to wfx_set_mfp_ap(). The issue is obvious in this function: memory allocated by ieee80211_beacon_get() is never released. Fixing this leak makes kmemleak happy.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/22/2025
The vulnerability identified as CVE-2024-26896 represents a memory leak within the Linux kernel's wireless subsystem, specifically affecting the wfx driver used for wireless communication. This issue was detected through kmemleak analysis which reported unreferenced memory objects that were allocated but never freed during the process of starting an access point. The affected kernel module is part of the mac80211 subsystem and operates in conjunction with the wfx wireless driver, where the memory leak occurs during beacon frame generation for access point operations. The leak manifests when the wfx_start_ap function attempts to set up an access point configuration, particularly when the wfx_set_mfp_ap function is invoked to configure management frame protection.
The technical flaw stems from improper memory management within the wireless driver's beacon frame handling mechanism. When the ieee80211_beacon_get function is called to allocate memory for beacon frames, the allocated memory is not properly released back to the system, creating a memory leak that accumulates over time. This pattern of memory allocation without corresponding deallocation violates fundamental memory management principles and is classified under CWE-401, which addresses improper management of dynamically allocated memory. The stack traces indicate that the memory allocation occurs through standard kernel memory allocation functions such as kmem_cache_alloc and __alloc_skb, but the subsequent deallocation is missing, causing the kernel's memory allocator to retain these memory segments indefinitely.
The operational impact of this memory leak is significant for wireless network operations, particularly in environments where access points are frequently started and stopped or where multiple wireless interfaces are active. Over time, the accumulation of leaked memory segments can lead to progressive memory exhaustion, potentially causing system instability, reduced performance, or even system crashes. The leak affects wpa_supplicant processes which are responsible for wireless network authentication and management, making this vulnerability particularly concerning for wireless infrastructure deployments. This type of vulnerability aligns with ATT&CK technique T1070.004, which covers "Indicator Removal on Host: File Deletion" but more specifically relates to memory management issues that can lead to resource exhaustion attacks.
The fix for this vulnerability involves ensuring that all memory allocated by ieee80211_beacon_get is properly released when it is no longer needed, typically through the use of appropriate kernel memory management functions such as dev_kfree_skb or similar deallocation mechanisms. This correction ensures that the memory allocated for beacon frames during access point startup is properly returned to the kernel's memory pool, preventing the accumulation of unreferenced memory segments. The resolution addresses the root cause by implementing proper resource cleanup within the wfx_set_mfp_ap function, where the memory leak was identified. This fix aligns with best practices for kernel memory management and prevents potential denial of service conditions that could arise from progressive memory consumption in wireless network operations.