CVE-2026-80939: wifi: rtw89: pci: add .shutdown callback to stop rfkill polling on reboot
In the Linux kernel, the following vulnerability has been resolved:
wifi: rtw89: pci: add .shutdown callback to stop rfkill polling on reboot
Since the hardware rfkill polling was introduced, arm64 platforms can panic with an asynchronous SError during warm reboot:
SError Interrupt on CPU8, code 0x00000000be000011 -- SError Workqueue: eventspowerefficient rfkillpoll [rfkill] rtw89pciopsread8+0x94/0x160 [rtw89pci] rtw89corerfkillpoll+0x50/0x1e0 [rtw89core] rtw89opsrfkillpoll+0x40/0x68 [rtw89core] ieee80211rfkillpoll+0x3c/0x70 [mac80211] cfg80211rfkillpoll+0x40/0x2a0 [cfg80211] rfkillpoll+0x30/0x88 [rfkill] Kernel panic - not syncing: Asynchronous SError Interrupt
On the reboot path the kernel only runs deviceshutdown(), which calls each driver's .shutdown callback; .remove is not invoked. The rtw89 PCI driver had no .shutdown callback, so nothing stopped the rfkill polling work while the platform was tearing the PCIe link down. Once the link is gone, the next MMIO read from the poll handler targets a non-responding device and is reported as a fatal asynchronous SError on arm64.
Add rtw89pcishutdown(), wired to all rtw89 PCI device drivers, which sets a new RTW89FLAGSHUTDOWN flag (mirroring the USB RTW89FLAGUNPLUGGED pattern). When the flag is set, rtw89opsrfkillpoll() returns early, so no MMIO read is issued to the chip after shutdown begins and the SError no longer occurs.
This does not call the full .remove path from .shutdown, to keep the shutdown handler minimal and avoid running the non-idempotent teardown twice.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Add a .shutdown callback (rtw89_pci_shutdown) to all rtw89 PCI device drivers so the shutdown path stops rfkill polling (prevents rtw89_ops_rfkill_poll/mmio reads during PCIe link teardown) and sets RTW89_FLAG_SHUTDOWN to make rtw89_ops_rfkill_poll() return early, avoiding the non-idempotent teardown being run twice.
Linux kernel (rtw89 PCI driver) Add rtw89_pci_shutdown() and wire it to all rtw89 PCI device drivers; set RTW89_FLAG_SHUTDOWN during shutdown and stop rfkill polling = implemented
Event History
Frequently Asked Questions
Which systems are exposed to the reboot failure?
The issue affects arm64 systems using an rtw89 PCI wireless device with hardware rfkill polling enabled. It occurs during a warm reboot when the PCIe link is torn down while rfkill polling remains active.
How can I tell whether this issue is occurring?
Affected systems can panic during reboot with an asynchronous SError. The kernel log or stack trace may show rfkill_poll and rtw89_pci_ops_read8, followed by a fatal asynchronous SError or “Kernel panic - not syncing: Asynchronous SError Interrupt.”},{
What condition triggers the crash?
The rtw89 PCI driver continues its rfkill polling work after device shutdown begins because its remove path is not called during reboot. A subsequent MMIO read after the PCIe link has disappeared can target a non-responding device and cause the fatal SError.