From a4190accbf7e05496754004bb701fb3e7d04e57f Mon Sep 17 00:00:00 2001 From: Johannes Berg Date: Tue, 13 Oct 2026 15:18:17 +0200 Subject: [PATCH] wifi: cfg80211: fix potential requested_regd leak If a custom regdomain is registered by a driver by calling regulatory_set_wiphy_regd() (the async one) before the wiphy is registered, and then registration fails or it's unregistered before the worker ran, we leak the regdomain. Free it on wiphy free. Link: https://patch.msgid.link/20261013151817.9c197c4779d4.I983cf65a625fbc99e13b0a2710167157c34b6cd9@changeid Signed-off-by: Johannes Berg --- net/wireless/core.c | 1 + 1 file changed, 1 insertion(+) diff --git a/net/wireless/core.c b/net/wireless/core.c index d2931b9d7e58..f4153c249599 100644 --- a/net/wireless/core.c +++ b/net/wireless/core.c @@ -1461,6 +1461,7 @@ void cfg80211_dev_free(struct cfg80211_registered_device *rdev) * can just free it here. */ kfree(rcu_dereference_raw(rdev->wiphy.regd)); + kfree(rdev->requested_regd); kfree(rdev); }