Executive brief
A vulnerability in the Realtek Wi-Fi driver (rtlwifi) for the Linux kernel could allow a local user to cause a system crash or instability. The issue occurs when the driver fails to properly clean up memory and system resources during a hardware initialization failure. This could lead to a denial-of-service condition, impacting the availability of the system.
Technical details
A vulnerability exists in the rtlwifi driver's PCI probe error path due to improper deinitialization order and missing cleanup calls. When the 'init_sw_vars' function fails, the driver incorrectly calls 'rtl_deinit_core', which can lead to invalid access because it attempts to destroy a workqueue that may not be properly initialized. Additionally, failing to call 'rtl_pci_deinit' and 'deinit_sw_vars' in specific error scenarios results in memory leaks. An attacker with local access could potentially trigger these error paths to cause a kernel panic or exhaust system memory. The issue has been resolved by ensuring deinitialization occurs in the correct reverse order of initialization.
Affected products
- Linux Linux kernel 2.6.38 to 5.4.291, 5.5 to 5.10.235, 5.11 to 5.15.179, 5.16 to 6.1.129, 6.2 to 6.6.76, 6.7 to 6.12.13, 6.13 to 6.13.2
Timeline
- 2024-12-06: patched: Initial patch authored
- 2025-03-06: disclosed: CVE published
References
- https://git.kernel.org/stable/c/32acebca0a51f5e372536bfdc0d7d332ab749013
- https://git.kernel.org/stable/c/455e0f40b5352186a9095f2135d5c89255e7c39a
- https://git.kernel.org/stable/c/624cea89a0865a2bc3e00182a6b0f954a94328b4
- https://git.kernel.org/stable/c/6b76bab5c257463302c9e97f5d84d524457468eb
- https://git.kernel.org/stable/c/85b67b4c4a0f8a6fb20cf4ef7684ff2b0cf559df
- https://git.kernel.org/stable/c/b96371339fd9cac90f5ee4ac17ee5c4cbbdfa6f7
- https://git.kernel.org/stable/c/e7ceefbfd8d447abc8aca8ab993a942803522c06