Executive brief
A vulnerability was identified in the Linux kernel's Libertas Wi-Fi driver that could cause system instability or crashes. The issue occurs when the driver attempts to perform certain cleanup tasks while the system is handling hardware interrupts, which is not permitted. This could lead to a denial-of-service scenario where the wireless connection or the entire system becomes unresponsive.
Technical details
The vulnerability exists in the 'if_usb.c' component of the Libertas Wi-Fi driver. The driver incorrectly called 'usb_kill_anchored_urbs()' within an interrupt context (such as the HCD giveback path) to enforce serialization on the TX path. Because 'usb_kill_urb' and related functions can sleep, calling them in an atomic interrupt context triggers a kernel warning or panic. The fix replaces the killing of URBs with a check using 'usb_anchor_empty()', returning '-EBUSY' if URBs are still pending, thereby avoiding the illegal sleep.
Affected products
- Linux Linux Kernel 5.10.252, 5.15.202, 6.1.165, 6.6.128, 6.12.75, 6.18.16, 6.19.6
Timeline
- 2026-06-24: disclosed
- 2026-06-24: advisory