Executive brief
The Linux kernel's rtw88 wireless driver has a resource leak in its PCI probe function. When NAPI initialization fails, the driver skips proper cleanup of PCI resources that were previously allocated, leading to memory leaks. This affects systems using Realtek RTL8188/8192 PCI wireless adapters.
Technical details
The vulnerability is a resource leak in the rtw_pci_probe() function within drivers/net/wireless/realtek/rtw88/pci.c. The root cause is an incorrect error path: rtw_pci_setup_resource() allocates PCI resources, but if rtw_pci_napi_init() subsequently fails, the error handler jumps to err_pci_declaim label, bypassing the rtw_pci_destroy() cleanup call that should release those resources. The fix adds a dedicated error label (err_destroy_rsrc) in the NAPI failure path to ensure rtw_pci_destroy() is called before resource declaim. This is a logic error occurring during device probe (local context, no network reachability required). The leak manifests as unreleased memory on failed device initialization.
Affected products
- Linux Linux kernel v7.1-rc7 and prior (rtw88 driver)
Timeline
- 2026-06-17: other: Bug reported by Dawei Feng via kernel analysis tool
- 2026-09-07: patched: Patch merged into stable kernel releases