From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 637C0404BC5 for ; Fri, 11 Sep 2026 19:46:27 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789155992; cv=none; b=h2U0frXeF04QOzsV95hjfysq/kauM/Mf30ydJQfHv2k7hdMNEOCM4Ch5I2ARBtUmN/ZWXuqoum6XPYw7ZuGHz3ZHDKvNBGIpPfJ0CT3qGm47oi41HtTymbae3sdDqBbqAjo1QwmTHieYDhrL4QhKOGemnrnkKl+QfI2CwPoDTko= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789155992; c=relaxed/simple; bh=ch8dKdEOfleYWWtAR7OUYMzeeGeGjL9zNcilh0UTw2I=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=QNea+fszWin24C1VPrMvQye060lVDIgJKWEKR0IdiFw20zhBGrNBb4PBgR+vgB0KBCw6w1pyDen8CBeemGkwkhyevJjKrR6rNvKR387a9KcSRMnG5xQHIx+Wee15JvxyHsYlALKeYUMZeBbxOFE8Yd8BgIv/CfSvqBoKs7clXe8= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=2uF/IKQC; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="2uF/IKQC" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 0A6561F000FF; Fri, 11 Sep 2026 19:46:21 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1789155982; bh=3Nx8Lg/yZVFiIobcQPPffef7ZC0GHdXpBFjl57GxPwE=; h=From:To:Cc:Subject:Date:Reply-To; b=2uF/IKQCIedWDP2dBLWD3I13zgb9w8v1kSyZS1ivZThQVwnuBU6NXXGbSYEqU8u7K VyC6Scqnx+YeH4+qjx7jDXUiZcxhGKTm+/tRCjgMRzLhL3/BxtLm1djoQ/O5TzhqIa Frjoc4RUKDerdsQ/1JevgRiC3/UXpJzY5QmJMse4= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2026-80947: wifi: rtl8xxxu: fix use-after-free from rx_urb_wq on stop Date: Fri, 11 Sep 2026 21:40:53 +0200 Message-ID: <2026091138-CVE-2026-80947-e8a7@gregkh> X-Mailer: git-send-email 2.55.0 Reply-To: , Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=4650; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=PqZZK8NyVruTnuO+VOJDUUpoSym5jszcNDLMVdf9mlk=; b=owGbwMvMwCRo6H6F97bub03G02pJDFlLIs2X/Z7sbyywr0k0UJepWfPf23mMyzIzyxdn1fpff qBs6LmgI5aFQZCJQVZMkeXLNp6j+ysOKXoZ2p6GmcPKBDKEgYtTACYSMJ1hfqbc7eJvF7LYRYun f5hqLic8oV7lNsP8wOOS/6ZK81rItOyPe2K0xV4xP0kZAA== X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit From: Greg Kroah-Hartman Description =========== In the Linux kernel, the following vulnerability has been resolved: wifi: rtl8xxxu: fix use-after-free from rx_urb_wq on stop rtl8xxxu arms rx_urb_wq from the RX completion path: rtl8xxxu_rx_complete() hands the URB to rtl8xxxu_queue_rx_urb(), which queues it on rx_urb_pending_list and, once the list grows past RTL8XXXU_RX_URB_PENDING_WATER, schedules rx_urb_wq. The worker rtl8xxxu_rx_urb_work() drains rx_urb_pending_list, recovers priv through container_of, and resubmits each URB through rtl8xxxu_submit_rx_urb(), which anchors it on rx_anchor and dereferences priv->udev. rtl8xxxu_stop() cancels the sibling work items (c2hcmd_work, ra_watchdog, update_beacon_work) but never cancels rx_urb_wq, so a worker armed during the last burst of RX traffic can run rtl8xxxu_rx_urb_work() after rtl8xxxu_disconnect() has called ieee80211_free_hw(), which frees priv, producing a use-after-free. The window opens under active RX traffic (pending count above the watermark) followed by a disconnect. There are two teardown races to close: * rtl8xxxu_queue_rx_urb() decided whether to enqueue under rx_urb_lock but called schedule_work() after dropping the lock. A completion that observed shutdown == false and released the lock could then call schedule_work() after rtl8xxxu_stop() had set shutdown and cancel_work_sync() had already returned, arming the worker to run after the teardown. Move schedule_work() under the same !shutdown branch so the arming decision is atomic with the shutdown check. * rtl8xxxu_rx_urb_work() anchors every URB it drained back onto rx_anchor through rtl8xxxu_submit_rx_urb(). A worker still running when usb_kill_anchored_urbs(&priv->rx_anchor) returned would submit a URB that escaped the kill. In rtl8xxxu_stop(), call cancel_work_sync(&priv->rx_urb_wq) before the kill so the worker is drained first. After priv->shutdown is set under rx_urb_lock, completions can no longer queue rx_urb_wq. cancel_work_sync() then drains the last queued or running worker, and the following usb_kill_anchored_urbs() kills the URBs it may have submitted. rtl8xxxu_disconnect() is covered because ieee80211_unregister_hw() guarantees .stop() runs for a live interface before ieee80211_free_hw() frees priv. The probe error path needs no cancel: rx_urb_wq is INIT_WORK()'d there but cannot have been scheduled, since no URB is submitted before ieee80211_register_hw() succeeds. This bug was found by static analysis. The Linux kernel CVE team has assigned CVE-2026-80947 to this issue. Affected and fixed versions =========================== Issue introduced in 4.4 with commit 26f1fad29ad973b0fb26a9ca3dcb2a73dde781aa and fixed in 6.12.109 with commit 800d2b490a9af1e7132a3564c2ad5a81292e5b40 Issue introduced in 4.4 with commit 26f1fad29ad973b0fb26a9ca3dcb2a73dde781aa and fixed in 6.18.50 with commit 620acb1e8037b73a457dc8ef20fc23fc7adcb405 Issue introduced in 4.4 with commit 26f1fad29ad973b0fb26a9ca3dcb2a73dde781aa and fixed in 7.2.4 with commit 972ab8b9c08f3eb3fa535082de2950dd93604dfd Issue introduced in 4.4 with commit 26f1fad29ad973b0fb26a9ca3dcb2a73dde781aa and fixed in 7.3-rc1 with commit 6c080026ecc17eecb103f8927c64ea73a74bb818 Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2026-80947 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: drivers/net/wireless/realtek/rtl8xxxu/core.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/800d2b490a9af1e7132a3564c2ad5a81292e5b40 https://git.kernel.org/stable/c/620acb1e8037b73a457dc8ef20fc23fc7adcb405 https://git.kernel.org/stable/c/972ab8b9c08f3eb3fa535082de2950dd93604dfd https://git.kernel.org/stable/c/6c080026ecc17eecb103f8927c64ea73a74bb818