CVE-2026-80947wifi: rtl8xxxu: fix use-after-free from rx_urb_wq on stop
- 7.8HighCVSS base score
- 0.16%Exploitation in 30 daysEPSS · top 94% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
In the Linux kernel, the following vulnerability has been resolved: wifi: rtl8xxxu: fix use-after-free from rx_urb_wq on stop rtl8xxxu arms rx_urb_wq from the RX completion path: rtl8xxxu_rx_complete() hands the URB to rtl8xxxu_queue_rx_urb(), which queues it on rx_urb_pending_list and, once the list grows past RTL8XXXU_RX_URB_PENDING_WATER, schedules rx_urb_wq. The worker rtl8xxxu_rx_urb_work() drains rx_urb_pending_list, recovers priv through container_of, and resubmits each URB through rtl8xxxu_submit_rx_urb(), which anchors it on rx_anchor and dereferences priv->udev. rtl8xxxu_stop() cancels the sibling work items (c2hcmd_work, ra_watchdog, update_beacon_work) but never cancels rx_urb_wq, so a worker armed during the last burst of RX traffic can run rtl8xxxu_rx_urb_work() after rtl8xxxu_disconnect() has called ieee80211_free_hw(), which frees priv, producing a use-after-free. The window opens under active RX traffic (pending count above the watermark) followed by a disconnect. There are two teardown races to close: * rtl8xxxu_queue_rx_urb() decided whether to enqueue under rx_urb_lock but called schedule_work() after dropping the lock. A completion that observed shutdown == false and released the lock could then call schedule_work() after rtl8xxxu_stop() had set shutdown and cancel_work_sync() had already returned, arming the worker to run after the teardown. Move schedule_work() under the same !shutdown branch so the arming decision is atomic with the shutdown check. * rtl8xxxu_rx_urb_work() anchors every URB it drained back onto rx_anchor through rtl8xxxu_submit_rx_urb(). A worker still running when usb_kill_anchored_urbs(&priv->rx_anchor) returned would submit a URB that escaped the kill. In rtl8xxxu_stop(), call cancel_work_sync(&priv->rx_urb_wq) before the kill so the worker is drained first. After priv->shutdown is set under rx_urb_lock, completions can no longer queue rx_urb_wq. cancel_work_sync() then drains the last queued or running worker, and the following usb_kill_anchored_urbs() kills the URBs it may have submitted. rtl8xxxu_disconnect() is covered because ieee80211_unregister_hw() guarantees .stop() runs for a live interface before ieee80211_free_hw() frees priv. The probe error path needs no cancel: rx_urb_wq is INIT_WORK()'d there but cannot have been scheduled, since no URB is submitted before ieee80211_register_hw() succeeds. This bug was found by static analysis.
Timeline
ID reserved
By Linux
- 16 days later
· 16 days later
Published
- 49 days later
· 49 days later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| LinuxCNA (assigner) | 3.1 | High7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| NVDNVD · Received | 3.1 | High7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
- EPSS (exploitation in 30 days)
- 0.16% · top 94% of all CVEs (13 Nov 2026)
The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.8.
Affected products
- affected 26f1fad29ad973b0fb26a9ca3dcb2a73dde781aa – < 75e7e19e9218e3b895e652f04acf08113dc3aa00
- affected 26f1fad29ad973b0fb26a9ca3dcb2a73dde781aa – < da1678cca182567fd84618b689f4424f3f55f712
- affected 26f1fad29ad973b0fb26a9ca3dcb2a73dde781aa – < 06e6bbb0abc2ae22e6e4d184250075e5c9e090d6
- affected 26f1fad29ad973b0fb26a9ca3dcb2a73dde781aa – < 17d5ae58973122eea7625a87cd3d80a8beb23b47
- affected 26f1fad29ad973b0fb26a9ca3dcb2a73dde781aa – < 800d2b490a9af1e7132a3564c2ad5a81292e5b40
- affected 26f1fad29ad973b0fb26a9ca3dcb2a73dde781aa – < 620acb1e8037b73a457dc8ef20fc23fc7adcb405
- affected 26f1fad29ad973b0fb26a9ca3dcb2a73dde781aa – < 972ab8b9c08f3eb3fa535082de2950dd93604dfd
- affected 26f1fad29ad973b0fb26a9ca3dcb2a73dde781aa – < 6c080026ecc17eecb103f8927c64ea73a74bb818
- affected 4.4
- unaffected < 4.4
- unaffected 5.10.273 – ≤ 5.10.*
- unaffected 5.15.224 – ≤ 5.15.*
- unaffected 6.1.191 – ≤ 6.1.*
- unaffected 6.6.160 – ≤ 6.6.*
- unaffected 6.12.109 – ≤ 6.12.*
- unaffected 6.18.50 – ≤ 6.18.*
- unaffected 7.2.4 – ≤ 7.2.*
- unaffected 7.3 – ≤ *
References
References8
- https://git.kernel.org/stable/c/75e7e19e9218e3b895e652f04acf08113dc3aa00 (opens in a new tab)
- https://git.kernel.org/stable/c/da1678cca182567fd84618b689f4424f3f55f712 (opens in a new tab)
- https://git.kernel.org/stable/c/06e6bbb0abc2ae22e6e4d184250075e5c9e090d6 (opens in a new tab)
- https://git.kernel.org/stable/c/17d5ae58973122eea7625a87cd3d80a8beb23b47 (opens in a new tab)
- https://git.kernel.org/stable/c/800d2b490a9af1e7132a3564c2ad5a81292e5b40 (opens in a new tab)
- https://git.kernel.org/stable/c/620acb1e8037b73a457dc8ef20fc23fc7adcb405 (opens in a new tab)
- https://git.kernel.org/stable/c/972ab8b9c08f3eb3fa535082de2950dd93604dfd (opens in a new tab)
- https://git.kernel.org/stable/c/6c080026ecc17eecb103f8927c64ea73a74bb818 (opens in a new tab)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2026-76270 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2026-80947)Record last updated .