CVE-2026-98351 in Linux
Summary
by MITRE • 10/06/2026
In the Linux kernel, the following vulnerability has been resolved:
wifi: virt_wifi: free skb when disconnected
When the simulated link is disconnected, virt_wifi_start_xmit() returns NET_XMIT_DROP without freeing the skb. dev_hard_start_xmit() treats this return value as consumed, so every packet sent while disconnected leaks its skb.
Free the skb before returning the drop status.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/06/2026
The vulnerability identified in the Linux kernel's virt_wifi driver represents a classic resource management flaw within network subsystem code paths. Specifically, the issue resides in the virt_wifi_start_xmit function, which is responsible for handling outgoing packet transmission over a simulated virtual Wi-Fi link. Under normal operational conditions, this function processes socket buffers and forwards them to the appropriate lower-level drivers or interfaces. However, when the simulated physical link state transitions to disconnected, the logic fails to properly release the memory allocated for the incoming network data structure known as the sk_buff or skb. This oversight leads directly to a kernel memory leak that accumulates over time as long as packets are attempted to be transmitted while the interface is down.
From a technical perspective, the root cause lies in the incorrect handling of return codes from transmission functions. When virt_wifi_start_xmit detects that the link is disconnected, it returns NET_XMIT_DROP to indicate that the packet could not be sent. In standard Linux networking stack behavior, returning this specific error code signals to the caller function dev_hard_start_xmit that the skb has been consumed or handled by the driver and should not be freed again by the upper layers. Because virt_wifi_start_xmit returns NET_XMIT_DROP without explicitly calling kfree_skb on the buffer, the kernel's network stack assumes ownership was transferred incorrectly. Consequently, the memory associated with each dropped packet remains allocated but unreachable, creating a persistent leak in kernel space rather than user space.
The operational impact of this vulnerability is primarily characterized by gradual system degradation due to resource exhaustion. Since every packet sent while the interface is disconnected results in an unfreed sk_buff, sustained network activity or automated background traffic can rapidly deplete available kernel memory. In severe cases, particularly on systems with limited RAM or those running long-duration services that frequently attempt connections over unstable virtual interfaces, this leak can lead to out-of-memory conditions within the kernel. This may trigger the Linux Out-Of-Memory killer to terminate critical processes, cause system instability, or result in a complete kernel panic if memory allocation fails for essential operations. While not directly exploitable by an external attacker for remote code execution, it serves as a reliable denial of service vector against local resources and can destabilize virtualized environments relying on virt_wifi interfaces.
This flaw aligns with CWE-401, which describes the missing release of memory after effective usage, specifically in the context of dynamic memory allocation failures during error handling paths. It also relates to improper resource cleanup mechanisms often seen in network driver implementations where state transitions are not fully accounted for in all code branches. From a threat modeling perspective using MITRE ATT&CK frameworks, this vulnerability falls under T1496 Resource Hijacking, specifically Subversion of Resource Management Limits, as it allows an entity to consume system resources beyond intended limits through inefficient handling of network buffers.
Mitigation strategies focus on applying the upstream kernel patch that corrects the logic within virt_wifi_start_xmit. The fix involves ensuring that before returning NET_XMIT_DROP, the driver explicitly frees the sk_buff using kfree_skb or equivalent memory release functions. System administrators should ensure their Linux kernels are updated to versions where this specific commit is included. For environments unable to immediately patch, monitoring kernel memory usage and network interface statistics for anomalies in dropped packet counts versus actual traffic volume can help detect early signs of resource leakage. Additionally, configuring virtual interfaces with appropriate timeouts or disabling them when not strictly needed can reduce the window of opportunity for the leak to accumulate significant impact.