UBUNTU-CVE-2026-80947: Use After Free

In the Linux kernel, the following vulnerability has been resolved: wifi: rtl8xxxu: fix use-after-free from rxurbwq on stop rtl8xxxu arms rxurbwq from the RX completion path: rtl8xxxurxcomplete() hands the URB to rtl8xxxuqueuerxurb(), which queues it on rxurbpendinglist and, once the list grows past RTL8XXXURXURBPENDINGWATER, schedules rxurbwq. The worker rtl8xxxurxurbwork() drains rxurbpendinglist, recovers priv through containerof, and resubmits each URB through rtl8xxxusubmitrxurb(), which anchors it on rxanchor and dereferences priv->udev. rtl8xxxustop() cancels the sibling work items (c2hcmdwork, rawatchdog, updatebeaconwork) but never cancels rxurbwq, so a worker armed during the last burst of RX traffic can run rtl8xxxurxurbwork() after rtl8xxxudisconnect() has called ieee80211freehw(), which frees priv, producing a use-after-free. The window opens under active RX traffic (pending count above the watermark) followed by a disconnect. There are two teardown races to close: rtl8xxxuqueuerxurb() decided whether to enqueue under rxurblock but called schedulework() after dropping the lock. A completion that observed shutdown == false and released the lock could then call schedulework() after rtl8xxxustop() had set shutdown and cancelworksync() had already returned, arming the worker to run after the teardown. Move schedulework() under the same !shutdown branch so the arming decision is atomic with the shutdown check. rtl8xxxurxurbwork() anchors every URB it drained back onto rxanchor through rtl8xxxusubmitrxurb(). A worker still running when usbkillanchoredurbs(&priv->rxanchor) returned would submit a URB that escaped the kill. In rtl8xxxustop(), call cancelworksync(&priv->rxurbwq) before the kill so the worker is drained first. After priv->shutdown is set under rxurblock, completions can no longer queue rxurbwq. cancelworksync() then drains the last queued or running worker, and the following usbkillanchoredurbs() kills the URBs it may have submitted. rtl8xxxudisconnect() is covered because ieee80211unregisterhw() guarantees .stop() runs for a live interface before ieee80211freehw() frees priv. The probe error path needs no cancel: rxurbwq is INITWORK()'d there but cannot have been scheduled, since no URB is submitted before ieee80211registerhw() succeeds. This bug was found by static analysis.