In the Linux kernel, the following vulnerability has been resolved:
wifi: rtw89: fix race between cancel_hw_scan and hw_scan completion
The rtwdev->scanning flag isn't protected by mutex originally, so cancel_hw_scan can pass the condition, but suddenly hw_scan completion unset the flag and calls ieee80211_scan_completed() that will free local->hw_scan_req. Then, cancel_hw_scan raises null-ptr-deref and use-after-free. Fix it by moving the check condition to where protected by mutex.
KASAN: null-ptr-deref in range [0x0000000000000088-0x000000000000008f] CPU: 2 PID: 6922 Comm: kworker/2:2 Tainted: G OE Hardware name: LENOVO 2356AD1/2356AD1, BIOS G7ETB6WW (2.76 ) 09/10/2019 Workqueue: events cfg80211_conn_work [cfg80211] RIP: 0010:rtw89_fw_h2c_scan_offload_be+0xc33/0x13c3 [rtw89_core] Code: 00 45 89 6c 24 1c 0f 85 23 01 00 00 48 8b 85 20 ff ff ff 48 8d RSP: 0018:ffff88811fd9f068 EFLAGS: 00010206 RAX: dffffc0000000000 RBX: ffff88811fd9f258 RCX: 0000000000000001 RDX: 0000000000000011 RSI: 0000000000000001 RDI: 0000000000000089 RBP: ffff88811fd9f170 R08: 0000000000000000 R09: 0000000000000000 R10: ffff88811fd9f108 R11: 0000000000000000 R12: ffff88810e47f960 R13: 0000000000000000 R14: 000000000000ffff R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff8881d6f00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007531dfca55b0 CR3: 00000001be296004 CR4: 00000000001706e0 Call Trace: <TASK> ? show_regs+0x61/0x73 ? __die_body+0x20/0x73 ? die_addr+0x4f/0x7b ? exc_general_protection+0x191/0x1db ? asm_exc_general_protection+0x27/0x30 ? rtw89_fw_h2c_scan_offload_be+0xc33/0x13c3 [rtw89_core] ? rtw89_fw_h2c_scan_offload_be+0x458/0x13c3 [rtw89_core] ? __pfx_rtw89_fw_h2c_scan_offload_be+0x10/0x10 [rtw89_core] ? do_raw_spin_lock+0x75/0xdb ? __pfx_do_raw_spin_lock+0x10/0x10 rtw89_hw_scan_offload+0xb5e/0xbf7 [rtw89_core] ? _raw_spin_unlock+0xe/0x24 ? __mutex_lock.constprop.0+0x40c/0x471 ? __pfx_rtw89_hw_scan_offload+0x10/0x10 [rtw89_core] ? __mutex_lock_slowpath+0x13/0x1f ? mutex_lock+0xa2/0xdc ? __pfx_mutex_lock+0x10/0x10 rtw89_hw_scan_abort+0x58/0xb7 [rtw89_core] rtw89_ops_cancel_hw_scan+0x120/0x13b [rtw89_core] ieee80211_scan_cancel+0x468/0x4d0 [mac80211] ieee80211_prep_connection+0x858/0x899 [mac80211] ieee80211_mgd_auth+0xbea/0xdde [mac80211] ? __pfx_ieee80211_mgd_auth+0x10/0x10 [mac80211] ? cfg80211_find_elem+0x15/0x29 [cfg80211] ? is_bss+0x1b7/0x1d7 [cfg80211] ieee80211_auth+0x18/0x27 [mac80211] cfg80211_mlme_auth+0x3bb/0x3e7 [cfg80211] cfg80211_conn_do_work+0x410/0xb81 [cfg80211] ? __pfx_cfg80211_conn_do_work+0x10/0x10 [cfg80211] ? __kasan_check_read+0x11/0x1f ? psi_group_change+0x8bc/0x944 ? __kasan_check_write+0x14/0x22 ? mutex_lock+0x8e/0xdc ? __pfx_mutex_lock+0x10/0x10 ? __pfx___radix_tree_lookup+0x10/0x10 cfg80211_conn_work+0x245/0x34d [cfg80211] ? __pfx_cfg80211_conn_work+0x10/0x10 [cfg80211] ? update_cfs_rq_load_avg+0x3bc/0x3d7 ? sched_clock_noinstr+0x9/0x1a ? sched_clock+0x10/0x24 ? sched_clock_cpu+0x7e/0x42e ? newidle_balance+0x796/0x937 ? __pfx_sched_clock_cpu+0x10/0x10 ? __pfx_newidle_balance+0x10/0x10 ? __kasan_check_read+0x11/0x1f ? psi_group_change+0x8bc/0x944 ? _raw_spin_unlock+0xe/0x24 ? raw_spin_rq_unlock+0x47/0x54 ? raw_spin_rq_unlock_irq+0x9/0x1f ? finish_task_switch.isra.0+0x347/0x586 ? __schedule+0x27bf/0x2892 ? mutex_unlock+0x80/0xd0 ? do_raw_spin_lock+0x75/0xdb ? __pfx___schedule+0x10/0x10 process_scheduled_works+0x58c/0x821 worker_thread+0x4c7/0x586 ? __kasan_check_read+0x11/0x1f kthread+0x285/0x294 ? __pfx_worker_thread+0x10/0x10 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x29/0x6f ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1b/0x30 </TASK>
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade kernel-debug-modules-extraUpgrade kernel-debug-devel-matchedUpgrade kernelUpgrade kernel-uki-virtUpgrade kernel-rt-64k-modules-coreUpgrade kernel-zfcpdump-develUpgrade kernel-docUpgrade kernel-toolsUpgrade kernel-modules-coreUpgrade kernel-rt-64k-modulesUpgrade kernel-zfcpdump-modulesUpgrade kernel-zfcpdump-coreUpgrade kernel-64k-devel-matchedUpgrade kernel-devel-matchedUpgrade kernel-64k-coreUpgrade kernel-headersUpgrade kernel-rtUpgrade kernel-rt-64k-modules-extraUpgrade rvUpgrade kernel-64k-debugUpgrade kernel-rt-debug-modules-extraUpgrade kernel-rt-modules-coreUpgrade kernel-64k-debug-modules-extraUpgrade kernel-rt-64k-debugUpgrade kernel-rt-64k-debug-coreUpgrade kernel-uki-virt-addonsUpgrade kernel-64k-modulesUpgrade kernel-zfcpdump-modules-coreUpgrade kernel-64k-debug-devel-matchedUpgrade libperfUpgrade kernel-abi-stablelistsUpgrade kernel-rt-64k-debug-modulesUpgrade kernel-cross-headersUpgrade kernel-rt-64kUpgrade kernel-tools-libs-develUpgrade kernel-rt-debug-develUpgrade kernel-rt-64k-debug-modules-extraUpgrade kernel-64k-debug-coreUpgrade kernel-rt-debug-modulesUpgrade perfUpgrade kernel-rt-modules-extraUpgrade kernel-rt-debug-coreUpgrade kernel-debug-modulesUpgrade kernel-64k-debug-modules-coreUpgrade kernel-rt-64k-coreUpgrade kernel-rt-develUpgrade kernel-debug-develUpgrade kernel-coreUpgrade kernel-64k-modules-extraUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-develUpgrade kernel-debug-modules-coreUpgrade rtlaUpgrade kernel-debug-uki-virtUpgrade kernel-rt-debugUpgrade kernel-modulesUpgrade kernel-rt-debug-modules-coreUpgrade kernel-rt-64k-debug-develUpgrade kernel-64k-modules-coreUpgrade kernel-debug-coreUpgrade kernel-64k-develUpgrade kernel-zfcpdump-devel-matchedUpgrade kernel-rt-coreUpgrade kernel-tools-libsUpgrade kernel-rt-64k-debug-modules-coreUpgrade kernel-rt-64k-develUpgrade kernel-64k-debug-develUpgrade kernel-debugUpgrade kernel-64kUpgrade python3-perfUpgrade kernel-rt-modulesUpgrade kernel-64k-debug-modulesUpgrade kernel-zfcpdumpUpgrade kernel-modules-extra | Nov 20, 2025 | Nov 11, 2025 |
| Debian | — | Upgrade linux | May 15, 2025 | Feb 27, 2025 |
| Oracle_linux | — | Upgrade kernel | Nov 28, 2025 | Feb 27, 2025 |
| Redhat_linux | — | Upgrade kernel-rtNo solution existsUpgrade kernel | Jul 9, 2025 | Feb 27, 2025 |
| Rocky_linux | — | Upgrade kernel-toolsUpgrade kernel-rtUpgrade kernel-zfcpdump-debuginfoUpgrade libperf-debuginfoUpgrade kernelUpgrade kernel-zfcpdump-modulesUpgrade rvUpgrade kernel-rt-debug-debuginfoUpgrade kernel-rt-modulesUpgrade kernel-debug-devel-matchedUpgrade kernel-debug-modules-extraUpgrade kernel-tools-libs-develUpgrade kernel-rt-modules-extraUpgrade kernel-uki-virt-addonsUpgrade kernel-rt-debug-coreUpgrade kernel-rt-develUpgrade kernel-debuginfo-common-s390xUpgrade kernel-zfcpdump-modules-coreUpgrade kernel-zfcpdump-devel-matchedUpgrade kernel-rt-modules-coreUpgrade kernel-rt-debuginfoUpgrade python3-perf-debuginfoUpgrade kernel-zfcpdump-coreUpgrade kernel-rt-debug-modules-extraUpgrade kernel-rt-coreUpgrade kernel-modules-extraUpgrade kernel-debugUpgrade kernel-rt-debug-modulesUpgrade kernel-modulesUpgrade kernel-rt-debugUpgrade kernel-devel-matchedUpgrade libperfUpgrade kernel-rt-debug-modules-coreUpgrade rtlaUpgrade kernel-develUpgrade kernel-debug-uki-virtUpgrade kernel-uki-virtUpgrade python3-perfUpgrade kernel-debug-modules-coreUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-debug-modulesUpgrade kernel-tools-libsUpgrade kernel-tools-debuginfoUpgrade perf-debuginfoUpgrade kernel-coreUpgrade kernel-debug-develUpgrade kernel-modules-coreUpgrade kernel-debug-debuginfoUpgrade kernel-rt-debug-develUpgrade perfUpgrade kernel-zfcpdump-develUpgrade kernel-zfcpdumpUpgrade kernel-debuginfoUpgrade kernel-debug-coreUpgrade kernel-zfcpdump-modules-extra | Feb 5, 2026 | Nov 21, 2025 |
| Suse | — | Upgrade reiserfs-kmp-64kbUpgrade kernel-azure-extraUpgrade kernel-docs-htmlUpgrade kernel-default-livepatch-develUpgrade kernel-azure-develUpgrade kernel-rt-vdsoUpgrade ocfs2-kmp-64kbUpgrade kernel-kvmsmallUpgrade reiserfs-kmp-rtUpgrade dtb-alteraUpgrade dtb-lgUpgrade dtb-marvellUpgrade kernel-source-rtUpgrade kernel-source-vanillaUpgrade kernel-obs-buildUpgrade kernel-rt-extraUpgrade kernel-debug-vdsoUpgrade dtb-freescaleUpgrade kernel-rt-optionalUpgrade gfs2-kmp-defaultUpgrade kernel-64kb-extraUpgrade kernel-rt_debugUpgrade kernel-rt_debug-develUpgrade kernel-azure-optionalUpgrade kernel-macrosUpgrade dtb-sprdUpgrade kernel-default-develUpgrade kselftests-kmp-azureUpgrade kernel-azureUpgrade kernel-azure-vdsoUpgrade cluster-md-kmp-azureUpgrade kernel-default-baseUpgrade kernel-64kb-optionalUpgrade dtb-socionextUpgrade kernel-rt_debug-vdsoUpgrade dlm-kmp-64kbUpgrade cluster-md-kmp-defaultUpgrade dlm-kmp-defaultUpgrade dtb-amdUpgrade kernel-64kbUpgrade dtb-renesasUpgrade kernel-syms-rtUpgrade cluster-md-kmp-64kbUpgrade kernel-debug-develUpgrade dtb-appleUpgrade kernel-rt-livepatch-develUpgrade kernel-source-azureUpgrade kselftests-kmp-rtUpgrade dtb-amazonUpgrade dtb-broadcomUpgrade kernel-default-livepatchUpgrade dtb-amlogicUpgrade kernel-kvmsmall-develUpgrade kernel-kvmsmall-vdsoUpgrade kernel-symsUpgrade dlm-kmp-azureUpgrade kernel-debugUpgrade dtb-mediatekUpgrade kselftests-kmp-defaultUpgrade kselftests-kmp-64kbUpgrade reiserfs-kmp-defaultUpgrade ocfs2-kmp-rtUpgrade dtb-nvidiaUpgrade ocfs2-kmp-defaultUpgrade ocfs2-kmp-azureUpgrade kernel-syms-azureUpgrade kernel-devel-azureUpgrade dtb-apmUpgrade kernel-default-vdsoUpgrade gfs2-kmp-azureUpgrade dtb-xilinxUpgrade dtb-allwinnerUpgrade cluster-md-kmp-rtUpgrade kernel-default-base-rebuildUpgrade dtb-exynosUpgrade dtb-armUpgrade reiserfs-kmp-azureUpgrade gfs2-kmp-64kbUpgrade dtb-qcomUpgrade kernel-default-extraUpgrade kernel-rt-develUpgrade kernel-obs-qaUpgrade kernel-sourceUpgrade gfs2-kmp-rtUpgrade dlm-kmp-rtUpgrade kernel-rtUpgrade dtb-rockchipUpgrade dtb-hisiliconUpgrade kernel-devel-rtUpgrade kernel-docsUpgrade dtb-caviumUpgrade kernel-zfcpdumpUpgrade kernel-develUpgrade kernel-default-optionalUpgrade kernel-defaultUpgrade kernel-64kb-devel | May 26, 2025 | Feb 27, 2025 |
| Ubuntu | — | Upgrade linux-image-azure-6.8Upgrade linux-image-kvmUpgrade linux-image-6.8.0-1044-gcp-fipsUpgrade linux-image-ibm-6.8Upgrade linux-image-oem-22.04Upgrade linux-image-raspi-realtimeUpgrade linux-image-gkeUpgrade linux-image-fips-6.8Upgrade linux-image-6.8.0-1029-azure-nvidiaUpgrade linux-image-gkeop-6.8Upgrade linux-image-nvidia-64kUpgrade linux-image-6.8.0-1043-nvidiaUpgrade linux-image-6.8.0-88-generic-64kUpgrade linux-image-6.8.0-1041-ibmUpgrade linux-image-6.8.0-1040-gke-64kUpgrade linux-image-oem-22.04bUpgrade linux-image-lowlatency-64k-hwe-22.04Upgrade linux-image-nvidia-lowlatency-64kUpgrade linux-image-lowlatency-64kUpgrade linux-image-oem-22.04aUpgrade linux-image-generic-hwe-22.04Upgrade linux-image-virtualUpgrade linux-image-nvidia-64k-hwe-22.04Upgrade linux-image-6.8.0-88-lowlatencyUpgrade linux-image-azure-lts-24.04Upgrade linux-image-generic-lpaeUpgrade linux-image-realtimeUpgrade linux-image-gcp-64k-lts-24.04Upgrade linux-image-azure-fips-6.8Upgrade linux-image-6.8.0-1040-oracle-64kUpgrade linux-image-6.8.0-1043-aws-fipsUpgrade linux-image-aws-64k-6.8Upgrade linux-image-ibm-lts-24.04Upgrade linux-image-oracle-64kUpgrade linux-image-fipsUpgrade linux-image-6.8.0-88-fipsUpgrade linux-image-lowlatencyUpgrade linux-image-ibmUpgrade linux-image-ibm-classicUpgrade linux-image-oracle-lts-24.04Upgrade linux-image-6.8.0-1044-gcp-64kUpgrade linux-image-gcpUpgrade linux-image-6.8.0-1043-raspiUpgrade linux-image-nvidia-lowlatency-64k-6.8Upgrade linux-image-aws-64kUpgrade linux-image-lowlatency-64k-6.8Upgrade linux-image-6.8.0-88-lowlatency-64kUpgrade linux-image-nvidia-hwe-22.04Upgrade linux-image-nvidia-64k-6.8Upgrade linux-image-gcp-6.8Upgrade linux-image-oracleUpgrade linux-image-6.8.0-88-genericUpgrade linux-image-6.8.0-1043-nvidia-64kUpgrade linux-image-generic-64k-hwe-22.04Upgrade linux-image-xilinxUpgrade linux-image-lowlatency-hwe-22.04Upgrade linux-image-generic-6.8Upgrade linux-image-nvidia-lowlatency-6.8Upgrade linux-image-awsUpgrade linux-image-6.8.0-1044-azureUpgrade linux-image-6.8.0-1040-gkeUpgrade linux-image-gke-6.8Upgrade linux-image-azure-fipsUpgrade linux-image-6.8.0-2034-raspi-realtimeUpgrade linux-image-6.8.0-1044-gcpUpgrade linux-image-gcp-64k-6.8Upgrade linux-image-virtual-6.8Upgrade linux-image-oracle-6.8Upgrade linux-image-nvidia-6.8Upgrade linux-image-aws-6.8Upgrade linux-image-6.8.0-1020-xilinxUpgrade linux-image-6.8.0-1043-nvidia-lowlatency-64kUpgrade linux-image-6.8.0-1044-azure-fipsUpgrade linux-image-xilinx-6.8Upgrade linux-image-6.8.0-1043-aws-64kUpgrade linux-image-oem-22.04cUpgrade linux-image-gcp-64kUpgrade linux-image-aws-64k-lts-24.04Upgrade linux-image-generic-64k-6.8Upgrade linux-image-6.8.1-1038-realtimeUpgrade linux-image-aws-fipsUpgrade linux-image-gke-64kUpgrade linux-image-lowlatency-6.8Upgrade linux-image-6.8.0-1040-oracleUpgrade linux-image-azure-nvidia-lts-24.04Upgrade linux-image-6.8.0-1043-nvidia-lowlatencyUpgrade linux-image-raspiUpgrade linux-image-genericUpgrade linux-image-6.8.0-1027-gkeopUpgrade linux-image-azureUpgrade linux-image-gcp-fips-6.8Upgrade linux-image-nvidia-lowlatencyUpgrade linux-image-gke-64k-6.8Upgrade linux-image-xilinx-zynqmpUpgrade linux-image-raspi-6.8Upgrade linux-image-aws-fips-6.8Upgrade linux-image-6.8.0-1043-awsUpgrade linux-image-oracle-64k-lts-24.04Upgrade linux-image-oem-22.04dUpgrade linux-image-realtime-6.8.1Upgrade linux-image-aws-lts-24.04Upgrade linux-image-azure-nvidia-6.8Upgrade linux-image-oracle-64k-6.8Upgrade linux-image-raspi-realtime-6.8Upgrade linux-image-gkeopUpgrade linux-image-gcp-fipsUpgrade linux-image-generic-64kUpgrade linux-image-nvidiaUpgrade linux-image-virtual-hwe-22.04Upgrade linux-image-gcp-lts-24.04 | Jun 26, 2025 | Feb 27, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub