Executive brief
The Linux kernel's Realtek WiFi driver (rtl8xxxu) contains a use-after-free vulnerability in its USB receive workqueue handler. When a WiFi interface is stopped while receiving data, a pending worker thread can access freed memory, potentially leading to system crashes or code execution. This affects systems using Realtek WiFi chipsets that depend on this kernel driver.
Technical details
The vulnerability is a use-after-free in the rtl8xxxu WiFi driver's RX URB handling. The root cause stems from a race condition: the rx_urb_wq workqueue is not properly cancelled during interface shutdown, allowing a worker thread to run after ieee80211_free_hw() has freed the driver's private structure (priv). Additionally, schedule_work() was called outside the rx_urb_lock protection window, creating a window where a completion handler could queue work after shutdown was initiated but before cancellation completed. The fix involves two changes: (1) moving schedule_work() inside the shutdown check lock to make the arming decision atomic, and (2) calling cancel_work_sync(&priv->rx_urb_wq) before usb_kill_anchored_urbs() to ensure the worker is fully drained before URBs are killed. The vulnerability requires active RX traffic followed by a disconnect to trigger.
Affected products
- Linux Linux kernel affected versions not specified in advisory
Timeline
- 2026-09-11: disclosed
- other: Found by static analysis, no evidence of active exploitation