CVE-2026-53112

Analyzed Analyzed - Analysis Complete

Use-After-Free in Linux Kernel RTLWIFI PCI Driver

Publication date: 2026-06-24

Last updated on: 2026-07-23

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: wifi: rtlwifi: pci: fix possible use-after-free caused by unfinished irq_prepare_bcn_tasklet The irq_prepare_bcn_tasklet is initialized in rtl_pci_init() and scheduled when RTL_IMR_BCNINT interrupt is triggered by hardware. But it is never killed in rtl_pci_deinit(). When the rtlwifi card probe fails or is being detached, the ieee80211_hw is deallocated. However, irq_prepare_bcn_tasklet may still be running or pending, leading to use-after-free when the freed ieee80211_hw is accessed in _rtl_pci_prepare_bcn_tasklet(). Similar to irq_tasklet, add tasklet_kill() in rtl_pci_deinit() to ensure that irq_prepare_bcn_tasklet is properly terminated before the ieee80211_hw is released. The issue was identified through static analysis.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-24

Last Modified

2026-07-23

Generated

2026-08-04

AI Q&A

2026-06-24

EPSS Evaluated

2026-08-02

NVD

CVE-2026-53112

EUVD

EUVD-2026-38980

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	From 6.2 (inc) to 6.6.141 (exc)
linux	linux_kernel	From 6.7 (inc) to 6.12.91 (exc)
linux	linux_kernel	From 6.13 (inc) to 6.18.33 (exc)
linux	linux_kernel	From 6.19 (inc) to 7.0.10 (exc)
linux	linux_kernel	From 5.16 (inc) to 6.1.175 (exc)
linux	linux_kernel	From 5.11 (inc) to 5.15.209 (exc)
linux	linux_kernel	From 2.6.38 (inc) to 5.10.258 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-416	The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

Attack-Flow Graph

Executive Summary

This vulnerability exists in the Linux kernel's Realtek rtlwifi PCI driver. It involves a use-after-free condition caused by an unfinished irq_prepare_bcn_tasklet. Specifically, the irq_prepare_bcn_tasklet is initialized and scheduled when a hardware interrupt occurs, but it is not properly terminated when the rtlwifi card is detached or its probe fails. As a result, the tasklet may still run or be pending after the ieee80211_hw structure it accesses has been freed, leading to a use-after-free scenario.

The fix involves adding a tasklet_kill() call in the rtl_pci_deinit() function to ensure the irq_prepare_bcn_tasklet is properly stopped before the ieee80211_hw is released.

Detection Guidance

This vulnerability was identified through static analysis and involves a use-after-free condition in the rtlwifi driver related to the irq_prepare_bcn_tasklet not being properly killed during device deinitialization.

There are no specific detection commands or network/system detection methods provided in the available information.

Impact Analysis

This use-after-free vulnerability can lead to undefined behavior in the Linux kernel, such as system crashes, memory corruption, or potential escalation of privileges if exploited. Since the tasklet may access freed memory, it could cause instability or allow an attacker to execute arbitrary code within the kernel context, depending on the exploitation scenario.

Mitigation Strategies

The vulnerability is fixed by ensuring that the irq_prepare_bcn_tasklet is properly terminated before the ieee80211_hw is released. This is done by adding tasklet_kill() in rtl_pci_deinit().

To mitigate this vulnerability, you should update your Linux kernel to a version that includes this fix.

Hi! I’m here to help you understand CVE-2026-53112. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70