Skip to main content

Linux Kernel CVE-2026-53112

| EUVDEUVD-2026-38980 HIGH
Use After Free (CWE-416)
2026-06-24 Linux GHSA-j8wh-h47x-6xr8
7.8
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
7.0 HIGH

Local-only kernel UAF triggered via a timing race during driver detach, so AV:L, AC:H and PR:L; kernel memory corruption yields C/I/A:H.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
4.7 MEDIUM
AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jul 23, 2026 - 21:40 vuln.today
CVSS changed
Jul 23, 2026 - 21:38 NVD
7.8 (HIGH)
Patch available
Jun 24, 2026 - 18:02 EUVD
CVE Published
Jun 24, 2026 - 16:30 nvd
HIGH 7.8
CVE Published
Jun 24, 2026 - 16:30 cve.org
UNKNOWN (no severity yet)

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

wifi: rtlwifi: pci: fix possible use-after-free caused by unfinished irq_prepare_bcn_tasklet

The irq_prepare_bcn_tasklet is initialized in rtl_pci_init() and scheduled when RTL_IMR_BCNINT interrupt is triggered by hardware. But it is never killed in rtl_pci_deinit(). When the rtlwifi card probe fails or is being detached, the ieee80211_hw is deallocated. However, irq_prepare_bcn_tasklet may still be running or pending, leading to use-after-free when the freed ieee80211_hw is accessed in _rtl_pci_prepare_bcn_tasklet().

Similar to irq_tasklet, add tasklet_kill() in rtl_pci_deinit() to ensure that irq_prepare_bcn_tasklet is properly terminated before the ieee80211_hw is released.

The issue was identified through static analysis.

AnalysisAI

Use-after-free in the Linux kernel's rtlwifi PCI driver (drivers/net/wireless/realtek/rtlwifi) lets a freed ieee80211_hw structure be accessed after teardown, because irq_prepare_bcn_tasklet is scheduled on the RTL_IMR_BCNINT beacon interrupt but never killed in rtl_pci_deinit(). When a Realtek PCIe Wi-Fi card fails to probe or is detached, the still-running or pending beacon tasklet dereferences the freed structure in _rtl_pci_prepare_bcn_tasklet(), enabling potential memory corruption and local privilege escalation. The flaw was found via static analysis; there is no public exploit identified at time of analysis and EPSS is low (0.16%, 6th percentile).

Technical ContextAI

The affected component is rtlwifi, the shared Linux mac80211 driver layer for Realtek PCIe wireless chipsets (rtl8192ce/de/se and related). During rtl_pci_init() the driver arms two tasklets - irq_tasklet and irq_prepare_bcn_tasklet - the latter fired from the ISR when the hardware raises the RTL_IMR_BCNINT beacon interrupt to prepare the next beacon frame. The root cause is CWE-416 (Use After Free): the cleanup path rtl_pci_deinit() calls tasklet_kill() for irq_tasklet but omits the beacon tasklet, so a deferred beacon tasklet can outlive the ieee80211_hw allocation that ieee80211_free_hw() releases on probe failure or driver unbind. When that tasklet later runs, _rtl_pci_prepare_bcn_tasklet() reads through the dangling hw/rtlpriv pointers. Per the CPE data (cpe:2.3:a:linux:linux) the affected product is the mainline Linux kernel; the bug traces back to commit 0c8173385e54 and the code has existed since around kernel 2.6.38.

RemediationAI

Vendor-released patch: update to a fixed stable kernel - 5.10.258, 5.15.209, 6.1.175, 6.6.141, 6.12.91, 7.0.10, 6.18.33 or mainline 7.1 - or the equivalent distribution package; Ubuntu users should apply the kernel updates in USN-8566-1, USN-8567-1 and USN-8568-1 (https://ubuntu.com/security/notices/USN-8568-1) and reboot. The upstream commits are published at git.kernel.org (e.g. https://git.kernel.org/stable/c/ae10d4a1ab6bcaa1336abb171908a9a365761d3e), and the one-line fix simply adds tasklet_kill() for irq_prepare_bcn_tasklet in rtl_pci_deinit(). Where immediate patching is not possible, the practical compensating control is to prevent the vulnerable driver from loading on systems that do not need Realtek PCIe Wi-Fi - blacklist the rtlwifi/rtl_pci modules (e.g. via modprobe blacklist) - which eliminates the code path entirely at the cost of disabling those wireless adapters; on systems that need Wi-Fi, restrict physical/local access and avoid repeated driver bind/unbind or hotplug operations since the UAF is tied to probe-failure and detach paths.

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
Image SLES15-SP7-Azure-3P Image SLES15-SP7-Azure-Basic Image SLES15-SP7-Azure-Standard Image SLES15-SP7-HPC-Azure Affected
Image SLES15-SP7-BYOS-Azure Image SLES15-SP7-BYOS-EC2 Image SLES15-SP7-BYOS-GCE Image SLES15-SP7-CHOST-BYOS-Aliyun Image SLES15-SP7-CHOST-BYOS-Azure Image SLES15-SP7-CHOST-BYOS-EC2 Image SLES15-SP7-CHOST-BYOS-GCE Image SLES15-SP7-CHOST-BYOS-GDC Image SLES15-SP7-CHOST-BYOS-SAP-CCloud Image SLES15-SP7-EC2 Image SLES15-SP7-EC2-ECS-HVM Image SLES15-SP7-GCE Image SLES15-SP7-HPC-BYOS-Azure Image SLES15-SP7-HPC-BYOS-EC2 Image SLES15-SP7-HPC-BYOS-GCE Image SLES15-SP7-Hardened-BYOS-Azure Image SLES15-SP7-Hardened-BYOS-EC2 Image SLES15-SP7-Hardened-BYOS-GCE Image SLES15-SP7-SAPCAL-Azure Image SLES15-SP7-SAPCAL-EC2 Image SLES15-SP7-SAPCAL-GCE Affected
Image SLES15-SP7-SAP-Azure Image SLES15-SP7-SAP-Azure-3P Image SLES15-SP7-SAP-BYOS-Azure Image SLES15-SP7-SAP-BYOS-EC2 Image SLES15-SP7-SAP-BYOS-GCE Image SLES15-SP7-SAP-EC2 Image SLES15-SP7-SAP-GCE Image SLES15-SP7-SAP-Hardened-Azure Image SLES15-SP7-SAP-Hardened-BYOS-Azure Image SLES15-SP7-SAP-Hardened-BYOS-EC2 Image SLES15-SP7-SAP-Hardened-BYOS-GCE Image SLES15-SP7-SAP-Hardened-GCE Affected
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed

Share

CVE-2026-53112 vulnerability details – vuln.today

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy