CVE-2026-53112: wifi: rtlwifi: pci: fix possible use-after-free caused by unfinished irq_prepare_bcn_tasklet
In the Linux kernel, the following vulnerability has been resolved:
wifi: rtlwifi: pci: fix possible use-after-free caused by unfinished irqpreparebcntasklet
The irqpreparebcntasklet is initialized in rtlpciinit() and scheduled when RTLIMRBCNINT interrupt is triggered by hardware. But it is never killed in rtlpcideinit(). When the rtlwifi card probe fails or is being detached, the ieee80211hw is deallocated. However, irqpreparebcntasklet may still be running or pending, leading to use-after-free when the freed ieee80211hw is accessed in rtlpcipreparebcntasklet().
Similar to irqtasklet, add taskletkill() in rtlpcideinit() to ensure that irqpreparebcntasklet is properly terminated before the ieee80211hw is released.
The issue was identified through static analysis.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.143.1-1
Event History
Frequently Asked Questions
What is the severity of CVE-2026-53112?
CVE-2026-53112 has a risk score of 34, indicating a moderate level of severity.
How do I fix CVE-2026-53112?
To fix CVE-2026-53112, update the Linux kernel to the latest version where this vulnerability has been patched.
What type of vulnerability is CVE-2026-53112?
CVE-2026-53112 is classified as a use-after-free vulnerability.
What component of the Linux kernel does CVE-2026-53112 affect?
CVE-2026-53112 affects the rtlwifi driver in the Linux kernel.
What could be the potential impact of exploiting CVE-2026-53112?
Exploiting CVE-2026-53112 could lead to memory corruption and potential system crashes.