Executive brief
A vulnerability in the Linux kernel's Realtek Wi-Fi driver could allow a local attacker to cause a system crash or potentially execute unauthorized code. The issue occurs when a Wi-Fi card is removed or fails to initialize, leaving background tasks running that try to access memory that has already been deleted. This primarily impacts system stability and availability for devices using Realtek PCI Wi-Fi adapters.
Technical details
A use-after-free (UAF) vulnerability exists in the Linux kernel's rtlwifi PCI driver (drivers/net/wireless/realtek/rtlwifi/pci.c). The 'irq_prepare_bcn_tasklet' is initialized during 'rtl_pci_init' but is not explicitly killed in 'rtl_pci_deinit'. If the Wi-Fi card probe fails or the device is detached, the 'ieee80211_hw' structure is deallocated while the tasklet may still be running or pending. When the tasklet eventually executes, it attempts to access the freed 'ieee80211_hw' memory in '_rtl_pci_prepare_bcn_tasklet'. The fix involves adding 'tasklet_kill()' to ensure the tasklet is terminated before memory release. This was discovered via static analysis.
Affected products
- Linux Linux 2.6.38 to 7.1
Timeline
- 2026-02-23: other: Patch submitted by developer
- 2026-06-24: disclosed: CVE published
References
- https://git.kernel.org/stable/c/008c456b76e9070979bc0e763897a5d3b0fdd4dc
- https://git.kernel.org/stable/c/039cd522dc70151da13329a5e3ae19b1736f468a
- https://git.kernel.org/stable/c/3c0e8a3179e6325a7dc6ce221aef0e03d854ab4b
- https://git.kernel.org/stable/c/7731b67bd59d1284d150cbe40a47e95a10613234
- https://git.kernel.org/stable/c/aa10a452e34810987fb9f4a047995b30003fb53f
- https://git.kernel.org/stable/c/ae10d4a1ab6bcaa1336abb171908a9a365761d3e
- https://git.kernel.org/stable/c/e40873820c9d245ce482faa7ad514ebdb3b8d23d