Executive brief
The Linux kernel's Intel WiFi driver contains a use-after-free vulnerability in its receive (RX) path cleanup code. When the driver initializes and then fails partway through, freed memory pointers are not cleared, allowing subsequent cleanup or retry operations to access stale data. An attacker with the ability to trigger driver initialization failures could potentially corrupt kernel memory or crash the system.
Technical details
A use-after-free vulnerability exists in the iwl_pcie_rx_free() function in drivers/net/wireless/intel/iwlwifi/pcie/gen1_2/rx.c. When iwl_pcie_tx_init() fails after RX initialization, the cleanup routine frees memory structures (rx_pool, global_table, rxq, alloc_page) but does not null the pointers, allowing later teardown or retry paths to dereference stale memory. The fix sets these pointers to NULL after freeing to prevent double-free or use-after-free conditions.
Affected products
- Linux Linux kernel Multiple versions (fix available in stable branches)
Timeline
- 2026-09-24: disclosed
- 2026-07-14: patched