CVE-2026-72005: wifi: rt2x00: avoid full teardown before work setup in probe
In the Linux kernel, the following vulnerability has been resolved:
wifi: rt2x00: avoid full teardown before work setup in probe
rt2x00libprobedev() uses the full rt2x00libremovedev() teardown for all probe failures. However, drvdata allocation and workqueue allocation can fail before intfwork, autowakeupwork and sleepwork have been initialized.
Do not enter the full remove path until the probe has reached the point where those work items are set up. Return directly for drvdata allocation failure, and use a small early cleanup path for workqueue allocation failure.
This issue was found by our static analysis tool and then confirmed by manual review of rt2x00libprobedev() and rt2x00libremovedev(). The early probe exits should not call a common teardown path that assumes the later work setup has already completed.
A QEMU PoC forced allocorderedworkqueue() to fail before the work initializers are reached. The resulting fail path entered rt2x00libremovedev(), and DEBUGOBJECTS reported invalid work drains with rt2x00libprobedev() and rt2x00libremovedev() in the stack.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Update the rt2x00 code so that, during early failures in rt2x00lib_probe_dev(), it does not enter the common teardown path used by rt2x00lib_remove_dev(). Specifically: return directly for drv_data allocation failure, and for workqueue allocation failure perform an early cleanup path that does not assume intf_work, autowakeup_work, and sleep_work have been initialized.
Linux kernel (wifi: rt2x00) rt2x00lib_probe_dev() teardown behavior during early probe failure = Return directly for drv_data allocation failure; use a small early cleanup path for workqueue allocation failure instead of the full rt2x00lib_remove_dev() teardown
Event History
Frequently Asked Questions
What is the severity of CVE-2026-72005?
CVE-2026-72005 has a risk rating of 13.
How do I fix CVE-2026-72005?
To fix CVE-2026-72005, ensure you update to the patched version of the Linux kernel that addresses this issue.
What are the consequences of CVE-2026-72005?
CVE-2026-72005 could potentially lead to resource allocation failures affecting the stability of WiFi devices using the Linux kernel.
Is CVE-2026-72005 exploitable remotely?
CVE-2026-72005 is unlikely to be remotely exploitable as it involves local resource handling in the kernel.
In which versions of Linux kernel is CVE-2026-72005 found?
CVE-2026-72005 is found in affected versions prior to the fix that was released on August 15, 2026.