---
id: CVE-2026-53258
title: 'wifi: fix leak if split 6 GHz scanning fails'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  wifi: fix leak if split 6 GHz scanning fails

  rdev->int_scan_req is leaked if cfg80211_scan() fails.  Note that it's
  supposed to be released at ___cfg80211_scan_done() …
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= c8cb5b854b40f2ce52ccd032fa19750f4181d5fc <
    87484866cae9130b97c2b356eeaea4f47b292f75
  - >-
    Linux >= c8cb5b854b40f2ce52ccd032fa19750f4181d5fc <
    df44397bbd8f3a38115c9590b686787e4aaf6327
  - >-
    Linux >= c8cb5b854b40f2ce52ccd032fa19750f4181d5fc <
    fb8db813eba2e56ee001c9fb5c2ce2cb78c42642
  - >-
    Linux >= c8cb5b854b40f2ce52ccd032fa19750f4181d5fc <
    a24134ddc18b4d440714365637d440b7121447b9
  - >-
    Linux >= c8cb5b854b40f2ce52ccd032fa19750f4181d5fc <
    e8694f7cc29287e843648d1075177b9a2000d957
  - Linux 5.10
published: '2026-06-25'
updated: '2026-10-21'
sourceUpdated: '2026-10-21T12:42:19.486Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-53258'
references:
  - url: 'https://git.kernel.org/stable/c/87484866cae9130b97c2b356eeaea4f47b292f75'
  - url: 'https://git.kernel.org/stable/c/df44397bbd8f3a38115c9590b686787e4aaf6327'
  - url: 'https://git.kernel.org/stable/c/fb8db813eba2e56ee001c9fb5c2ce2cb78c42642'
  - url: 'https://git.kernel.org/stable/c/a24134ddc18b4d440714365637d440b7121447b9'
  - url: 'https://git.kernel.org/stable/c/e8694f7cc29287e843648d1075177b9a2000d957'
tags:
  - cve.org
epss: 0.00112
epssPercentile: 0.01321
ingestedAt: '2026-10-21T12:48:53.618Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

wifi: fix leak if split 6 GHz scanning fails

rdev->int_scan_req is leaked if cfg80211_scan() fails.  Note that it's
supposed to be released at ___cfg80211_scan_done() but this doesn't happen
as rdev->scan_req is NULL at that point, too, leading to the early return
from the freeing function.

unreferenced object 0xffff8881161d0800 (size 512):
  comm "wpa_supplicant", pid 379, jiffies 4294749765
  hex dump (first 32 bytes):
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    00 00 00 00 00 00 00 00 f0 81 13 16 81 88 ff ff  ................
  backtrace (crc c867fdb6):
    kmemleak_alloc+0x89/0x90
    __kmalloc_noprof+0x2fd/0x410
    cfg80211_scan+0x133/0x730
    nl80211_trigger_scan+0xc69/0x1cc0
    genl_family_rcv_msg_doit+0x204/0x2f0
    genl_rcv_msg+0x431/0x6b0
    netlink_rcv_skb+0x143/0x3f0
    genl_rcv+0x27/0x40
    netlink_unicast+0x4f6/0x820
    netlink_sendmsg+0x797/0xce0
    __sock_sendmsg+0xc4/0x160
    ____sys_sendmsg+0x5e4/0x890
    ___sys_sendmsg+0xf8/0x180
    __sys_sendmsg+0x136/0x1e0
    __x64_sys_sendmsg+0x76/0xc0
    x64_sys_call+0x13f0/0x17d0

Found by Linux Verification Center (linuxtesting.org).

## Affected

- `Linux >= c8cb5b854b40f2ce52ccd032fa19750f4181d5fc < 87484866cae9130b97c2b356eeaea4f47b292f75`
- `Linux >= c8cb5b854b40f2ce52ccd032fa19750f4181d5fc < df44397bbd8f3a38115c9590b686787e4aaf6327`
- `Linux >= c8cb5b854b40f2ce52ccd032fa19750f4181d5fc < fb8db813eba2e56ee001c9fb5c2ce2cb78c42642`
- `Linux >= c8cb5b854b40f2ce52ccd032fa19750f4181d5fc < a24134ddc18b4d440714365637d440b7121447b9`
- `Linux >= c8cb5b854b40f2ce52ccd032fa19750f4181d5fc < e8694f7cc29287e843648d1075177b9a2000d957`
- `Linux 5.10`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.