CVE-2026-53112

Vulnerability overview

In the Linux kernel, the following vulnerability has been resolved: wifi: rtlwifi: pci: fix possible use-after-free caused by unfinished irq_prepare_bcn_tasklet The irq_prepare_bcn_tasklet is initialized in rtl_pci_init() and scheduled when RTL_IMR_BCNINT interrupt is triggered by hardware. But it is never killed in rtl_pci_deinit(). When the rtlwifi card probe fails or is being detached, the ieee80211_hw is deallocated. However, irq_prepare_bcn_tasklet may still be running or pending, leading to use-after-free when the freed ieee80211_hw is accessed in _rtl_pci_prepare_bcn_tasklet(). Simil...

Affected product and versions

Product

Linux Linux, linux kernel

Affected versions

>= 0c8173385e549f95cd80c3fff5aab87b4f881d8d < ae10d4a1ab6bcaa1336abb171908a9a365761d3e, >= 0c8173385e549f95cd80c3fff5aab87b4f881d8d < fac1079e0fdec6df6d7562c21941587236dc3def, >= 0c8173385e549f95cd80c3fff5aab87b4f881d8d < e40873820c9d245ce482faa7ad514ebdb3b8d23d, >= 0c8173385e549f95cd80c3fff5aab87b4f881d8d < 008c456b76e9070979bc0e763897a5d3b0fdd4dc, >= 0c8173385e549f95cd80c3fff5aab87b4f881d8d < 7731b67bd59d1284d150cbe40a47e95a10613234, >= 0c8173385e549f95cd80c3fff5aab87b4f881d8d < aa10a452e34810987fb9f4a047995b30003fb53f, >= 0c8173385e549f95cd80c3fff5aab87b4f881d8d < 3c0e8a3179e6325a7dc6ce221aef0e03d854ab4b, >= 0c8173385e549f95cd80c3fff5aab87b4f881d8d < 039cd522dc70151da13329a5e3ae19b1736f468a, >= 2.6.38, >= 2.6.38 < 5.10.258, >= 5.11 < 5.15.209, >= 5.16 < 6.1.175, >= 6.2 < 6.6.141, >= 6.7 < 6.12.91, >= 6.13 < 6.18.33, >= 6.19 < 7.0.10

Fixed versions

5.10.258, 5.15.209, 6.1.175, 6.6.141, 6.12.91, 6.18.33, 7.0.10

Technical data

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-416