PT-2026-52006 · Linux · Linux

Published 2026-06-24 · Updated 2026-06-24 · CVE-2026-53112

NVD

In the Linux kernel, the following vulnerability has been resolved:

wifi: rtlwifi: pci: fix possible use-after-free caused by unfinished irq prepare bcn tasklet

The irq prepare bcn tasklet is initialized in rtl pci init() and scheduled when RTL IMR BCNINT interrupt is triggered by hardware. But it is never killed in rtl pci deinit(). When the rtlwifi card probe fails or is being detached, the ieee80211 hw is deallocated. However, irq prepare bcn tasklet may still be running or pending, leading to use-after-free when the freed ieee80211 hw is accessed in rtl pci prepare bcn tasklet().

Similar to irq tasklet, add tasklet kill() in rtl pci deinit() to ensure that irq prepare bcn tasklet is properly terminated before the ieee80211 hw is released.

The issue was identified through static analysis.

Related Identifiers

CVE-2026-53112

Affected Products

Linux

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2026-53112 · Security Note
• https://git.kernel.org/stable/c/ae10d4a1ab6bcaa1336abb171908a9a365761d3e · Note
• https://git.kernel.org/stable/c/fac1079e0fdec6df6d7562c21941587236dc3def · Note
• https://git.kernel.org/stable/c/3c0e8a3179e6325a7dc6ce221aef0e03d854ab4b · Note
• https://git.kernel.org/stable/c/7731b67bd59d1284d150cbe40a47e95a10613234 · Note
• https://git.kernel.org/stable/c/008c456b76e9070979bc0e763897a5d3b0fdd4dc · Note
• https://git.kernel.org/stable/c/039cd522dc70151da13329a5e3ae19b1736f468a · Note
• https://git.kernel.org/stable/c/aa10a452e34810987fb9f4a047995b30003fb53f · Note
• https://git.kernel.org/stable/c/e40873820c9d245ce482faa7ad514ebdb3b8d23d · Note