CVE-2023-54131

wifi: rt2x00: Fix memory leak when handling surveys

State: Published
Severity: Not scored
Published: Dec 24, 2025
Updated: May 11, 2026
Reserved: Dec 24, 2025

Description

In the Linux kernel, the following vulnerability has been resolved:

wifi: rt2x00: Fix memory leak when handling surveys

When removing a rt2x00 device, its associated channel surveys are not freed, causing a memory leak observable with kmemleak:

unreferenced object 0xffff9620f0881a00 (size 512): comm "systemd-udevd", pid 2290, jiffies 4294906974 (age 33.768s) hex dump (first 32 bytes): 70 44 12 00 00 00 00 00 92 8a 00 00 00 00 00 00 pD.............. 00 00 00 00 00 00 00 00 ab 87 01 00 00 00 00 00 ................ backtrace: [<ffffffffb0ed858b>] __kmalloc+0x4b/0x130 [<ffffffffc1b0f29b>] rt2800_probe_hw+0xc2b/0x1380 [rt2800lib] [<ffffffffc1a9496e>] rt2800usb_probe_hw+0xe/0x60 [rt2800usb] [<ffffffffc1ae491a>] rt2x00lib_probe_dev+0x21a/0x7d0 [rt2x00lib] [<ffffffffc1b3b83e>] rt2x00usb_probe+0x1be/0x980 [rt2x00usb] [<ffffffffc05981e2>] usb_probe_interface+0xe2/0x310 [usbcore] [<ffffffffb13be2d5>] really_probe+0x1a5/0x410 [<ffffffffb13be5c8>] __driver_probe_device+0x78/0x180 [<ffffffffb13be6fe>] driver_probe_device+0x1e/0x90 [<ffffffffb13be972>] __driver_attach+0xd2/0x1c0 [<ffffffffb13bbc57>] bus_for_each_dev+0x77/0xd0 [<ffffffffb13bd2a2>] bus_add_driver+0x112/0x210 [<ffffffffb13bfc6c>] driver_register+0x5c/0x120 [<ffffffffc0596ae8>] usb_register_driver+0x88/0x150 [usbcore] [<ffffffffb0c011c4>] do_one_initcall+0x44/0x220 [<ffffffffb0d6134c>] do_init_module+0x4c/0x220

Fix this by freeing the channel surveys on device removal.

Tested with a RT3070 based USB wireless adapter.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	5447626910f5b8d964761ed4fa4feaf1a3ac47d0 to before eb77c0c0a17c53d83b5fe8e46490fb0a7ed9e6afAffected 5447626910f5b8d964761ed4fa4feaf1a3ac47d0 to before bea3f8aa999318bdffa2d17753e492f76904f0ceAffected 5447626910f5b8d964761ed4fa4feaf1a3ac47d0 to before 494064ffd60d044c097d514917c40913d1affbcaAffected 5447626910f5b8d964761ed4fa4feaf1a3ac47d0 to before 0354bce76ed1d775904acdb4cc0bf88c5b9b5b9fAffected 5447626910f5b8d964761ed4fa4feaf1a3ac47d0 to before cbef9a83c51dfcb07f77cfa6ac26f53a1ea86f49Affected
LinuxLinux	5.11Affected before 5.11Not affected 5.15.111 through 5.15.Not affected 6.1.28 through 6.1.Not affected 6.2.15 through 6.2.Not affected 6.3.2 through 6.3.Not affected 6.4 and laterNot affected

Product

Versions

LinuxLinux

5447626910f5b8d964761ed4fa4feaf1a3ac47d0 to before eb77c0c0a17c53d83b5fe8e46490fb0a7ed9e6afAffected
5447626910f5b8d964761ed4fa4feaf1a3ac47d0 to before bea3f8aa999318bdffa2d17753e492f76904f0ceAffected
5447626910f5b8d964761ed4fa4feaf1a3ac47d0 to before 494064ffd60d044c097d514917c40913d1affbcaAffected
5447626910f5b8d964761ed4fa4feaf1a3ac47d0 to before 0354bce76ed1d775904acdb4cc0bf88c5b9b5b9fAffected
5447626910f5b8d964761ed4fa4feaf1a3ac47d0 to before cbef9a83c51dfcb07f77cfa6ac26f53a1ea86f49Affected

LinuxLinux

5.11Affected
before 5.11Not affected
5.15.111 through 5.15.*Not affected
6.1.28 through 6.1.*Not affected
6.2.15 through 6.2.*Not affected
6.3.2 through 6.3.*Not affected
6.4 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.