CVE-2026-80939: wifi: rtw89: pci: add .shutdown callback to stop rfkill polling on reboot
In the Linux kernel, the following vulnerability has been resolved:
wifi: rtw89: pci: add .shutdown callback to stop rfkill polling on reboot
Since the hardware rfkill polling was introduced, arm64 platforms can panic with an asynchronous SError during warm reboot:
SError Interrupt on CPU8, code 0x00000000be000011 -- SError Workqueue: eventspowerefficient rfkillpoll [rfkill] rtw89pciopsread8+0x94/0x160 [rtw89pci] rtw89corerfkillpoll+0x50/0x1e0 [rtw89core] rtw89opsrfkillpoll+0x40/0x68 [rtw89core] ieee80211rfkillpoll+0x3c/0x70 [mac80211] cfg80211rfkillpoll+0x40/0x2a0 [cfg80211] rfkillpoll+0x30/0x88 [rfkill] Kernel panic - not syncing: Asynchronous SError Interrupt
On the reboot path the kernel only runs deviceshutdown(), which calls each driver's .shutdown callback; .remove is not invoked. The rtw89 PCI driver had no .shutdown callback, so nothing stopped the rfkill polling work while the platform was tearing the PCIe link down. Once the link is gone, the next MMIO read from the poll handler targets a non-responding device and is reported as a fatal asynchronous SError on arm64.
Add rtw89pcishutdown(), wired to all rtw89 PCI device drivers, which sets a new RTW89FLAGSHUTDOWN flag (mirroring the USB RTW89FLAGUNPLUGGED pattern). When the flag is set, rtw89opsrfkillpoll() returns early, so no MMIO read is issued to the chip after shutdown begins and the SError no longer occurs.
This does not call the full .remove path from .shutdown, to keep the shutdown handler minimal and avoid running the non-idempotent teardown twice.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.113-1~deb12u1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Configuration
Add rtw89_pci_shutdown() as the .shutdown callback for all rtw89 PCI device drivers; have it set RTW89_FLAG_SHUTDOWN, and make rtw89_ops_rfkill_poll() return early when that flag is set to stop rfkill polling and prevent MMIO reads after shutdown begins.
Linux rtw89 PCI device drivers .shutdown callback = rtw89_pci_shutdown
Event History
Frequently Asked Questions
Which systems are exposed to the reboot failure?
The issue affects arm64 systems using an rtw89 PCI wireless device with hardware rfkill polling enabled. It occurs during a warm reboot when the PCIe link is torn down while rfkill polling remains active.
How can I tell whether this issue is occurring?
Affected systems can panic during reboot with an asynchronous SError. The kernel log or stack trace may show rfkill_poll and rtw89_pci_ops_read8, followed by a fatal asynchronous SError or “Kernel panic - not syncing: Asynchronous SError Interrupt.”},{
What condition triggers the crash?
The rtw89 PCI driver continues its rfkill polling work after device shutdown begins because its remove path is not called during reboot. A subsequent MMIO read after the PCIe link has disappeared can target a non-responding device and cause the fatal SError.