CVE-2026-80947

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

wifi: rtl8xxxu: fix use-after-free from rx_urb_wq on stop

rtl8xxxu arms rx_urb_wq from the RX completion path:

rtl8xxxu_rx_complete() hands the URB to rtl8xxxu_queue_rx_urb(), which

queues it on rx_urb_pending_list and, once the list grows past

RTL8XXXU_RX_URB_PENDING_WATER, schedules rx_urb_wq. The worker

rtl8xxxu_rx_urb_work() drains rx_urb_pending_list, recovers priv through

container_of, and resubmits each URB through rtl8xxxu_submit_rx_urb(),

which anchors it on rx_anchor and dereferences priv->udev.

rtl8xxxu_stop() cancels the sibling work items (c2hcmd_work, ra_watchdog,

update_beacon_work) but never cancels rx_urb_wq, so a worker armed during

the last burst of RX traffic can run rtl8xxxu_rx_urb_work() after

rtl8xxxu_disconnect() has called ieee80211_free_hw(), which frees priv,

producing a use-after-free. The window opens under active RX traffic

(pending count above the watermark) followed by a disconnect.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References