Executive brief
The Realtek WiFi driver in the Linux kernel contains a resource cleanup bug in its PCI probe initialization routine. When certain hardware errors occur during driver initialization, the code incorrectly skips essential cleanup steps, leading to leaked memory and improperly released resources that can cause system instability or create an attack surface.
Technical details
The vulnerability is a resource leak (CWE-772) in the rtl_pci_probe() function in drivers/net/wireless/realtek/rtlwifi/pci.c. An incorrect goto label causes the error path to bypass critical cleanup functions (rtl_deinit_rfkill, rtl_debug_remove_one, ieee80211_unregister_hw) when IRQ handler registration fails. This occurs after successful initialization of rfkill, hardware registration, and debug structures, which must be reverted. The attack vector is local/adjacent (requires hardware interaction or local system access). The fix updates the goto label and adds the missing cleanup function calls to the proper error path. Patches are available in stable kernel releases.
Affected products
- Linux Linux kernel All versions with rtlwifi PCI driver prior to patched releases
Timeline
- 2026-09-17: disclosed