Executive brief
A vulnerability exists in the Linux kernel's Realtek 802.11ax (rtw89) wireless driver. This flaw occurs during the handling of network data packets, where a race condition can lead to the system attempting to use memory that has already been released. An exploit could lead to a system crash (denial of service) or potentially allow an attacker to execute unauthorized code, impacting the stability and security of devices using these Realtek Wi-Fi chips.
Technical details
A use-after-free (UAF) vulnerability exists in the Realtek rtw89 wireless driver within the Linux kernel, specifically in the rtw89_core_tx_kick_off_and_wait() function. The root cause is a race condition between the waiting thread and the completing thread during TX status processing. The completing thread may signal completion and proceed to free the socket buffer (skb) data before the waiting thread has finished accessing it, even if a timeout occurs. An attacker within radio range (adjacent network) could potentially trigger this race condition to cause memory corruption or a kernel panic. The fix introduces a garbage collection work function to manage the lifecycle of TX wait objects and their associated buffers safely.
Affected products
- Linux Linux Kernel 1ae5ca615285 to 3e31a6bc0731
Timeline
- 2025-09-22: patched: Initial patch committed to mainline kernel tree.
- 2025-10-15: disclosed: CVE published to NVD.