Executive brief
The Linux kernel's rtw88 WiFi driver contains a logic error that triggers warnings and instability when updating wireless transmission rates during channel changes. This can cause system warnings, potential performance degradation, or service disruptions on systems using this WiFi hardware.
Technical details
The vulnerability is a RCU (Read-Copy-Update) synchronization violation in the rtw88 WiFi driver's sta_rc_update handler. The ieee80211_ops::sta_rc_update callback must operate atomically because the caller (ieee80211_chan_bw_change) holds an RCU read-side lock, but the driver's implementation calls blocking USB operations (rtw_fw_send_h2c_command) that trigger a voluntary context switch within the RCU critical section, violating RCU constraints. This manifests as a kernel warning at rcu_note_context_switch. The fix moves rate update operations to a deferred work queue to avoid holding the RCU lock during blocking I/O. No authentication or user interaction is required; the issue triggers automatically during WiFi channel bandwidth changes.
Affected products
- Linux Linux kernel affected versions prior to fix
Timeline
- 2023: disclosed: CVE-2023-54071 assigned
- 2024: patched: Fix merged into Linux kernel to defer rate update to work queue