Linux Kernel WiFi Driver Memory Leak Vulnerability in RTW88 USB Handling

A memory leak vulnerability has been identified in the Linux kernel's WiFi driver for Realtek RTW88 USB chips. This issue arises when the function rtw_usb_write_port() fails to submit a USB Request Block (URB), due to reasons such as device disconnection or memory allocation errors. The failure prevents the completion callback from executing, which is crucial for freeing allocated socket buffers and transaction control blocks. As a result, the driver inadvertently leaks memory by not releasing these resources. The vulnerability was discovered during real-world device disconnection and reconnection scenarios, as well as under conditions of memory pressure.

Impact

The vulnerability leads to memory leaks of socket buffers and transaction control blocks, causing potential memory exhaustion over time.

Reproduction

The vulnerability can be reproduced by disconnecting and reconnecting a device while the WiFi driver is active, particularly under conditions of high memory usage. This will trigger the USB write failure, causing the driver to leak memory by not properly freeing the affected resources.

Remediation

Users can apply the latest patches available in the Linux kernel stable tree to address this vulnerability.