In the Linux kernel, the following vulnerability has been resolved:
staging: rtl8712: fix use-after-free in rtl8712_dl_fw
Syzbot reported use-after-free in rtl8712_dl_fw(). The problem was in race condition between r871xu_dev_remove() ->ndo_open() callback.
It's easy to see from crash log, that driver accesses released firmware in ->ndo_open() callback. It may happen, since driver was releasing firmware _before_ unregistering netdev. Fix it by moving unregister_netdev() before cleaning up resources.
Call Trace: ... rtl871x_open_fw drivers/staging/rtl8712/hal_init.c:83 [inline] rtl8712_dl_fw+0xd95/0xe10 drivers/staging/rtl8712/hal_init.c:170 rtl8712_hal_init drivers/staging/rtl8712/hal_init.c:330 [inline] rtl871x_hal_init+0xae/0x180 drivers/staging/rtl8712/hal_init.c:394 netdev_open+0xe6/0x6c0 drivers/staging/rtl8712/os_intfs.c:380 __dev_open+0x2bc/0x4d0 net/core/dev.c:1484
Freed by task 1306: ... release_firmware+0x1b/0x30 drivers/base/firmware_loader/main.c:1053 r871xu_dev_remove+0xcc/0x2c0 drivers/staging/rtl8712/usb_intf.c:599 usb_unbind_interface+0x1d8/0x8d0 drivers/usb/core/driver.c:458
CVSS Details
- CVSS 3.1 Base Score: 7
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux | Jul 30, 2024 | May 22, 2024 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | May 22, 2024 |
| Suse | — | Upgrade kernel-source-azureUpgrade dtb-broadcomUpgrade kernel-default-extraUpgrade dtb-freescaleUpgrade kernel-docs-htmlUpgrade kernel-default-baseUpgrade kernel-rt_debug-develUpgrade kernel-syms-rtUpgrade kernel-rt-livepatch-develUpgrade kselftests-kmp-defaultUpgrade cluster-md-kmp-64kbUpgrade kernel-kvmsmall-livepatch-develUpgrade kernel-rt-optionalUpgrade kernel-source-rtUpgrade dlm-kmp-defaultUpgrade kernel-rt-vdsoUpgrade kernel-obs-qaUpgrade kernel-debug-vdsoUpgrade dtb-lgUpgrade kernel-azure-vdsoUpgrade kernel-default-livepatchUpgrade kselftests-kmp-rtUpgrade kernel-source-vanillaUpgrade kernel-devel-azureUpgrade kernel-64kb-optionalUpgrade kernel-rt_debug-vdsoUpgrade cluster-md-kmp-defaultUpgrade kernel-default-develUpgrade kernel-debug-develUpgrade dtb-sprdUpgrade reiserfs-kmp-64kbUpgrade kernel-obs-buildUpgrade kernel-kvmsmallUpgrade kernel-defaultUpgrade gfs2-kmp-rtUpgrade kernel-docsUpgrade kernel-azure-livepatch-develUpgrade kernel-default-livepatch-develUpgrade kernel-azure-develUpgrade ocfs2-kmp-64kbUpgrade dtb-amlogicUpgrade kernel-rt_debugUpgrade dtb-amdUpgrade dtb-marvellUpgrade kernel-azure-extraUpgrade dtb-amazonUpgrade kernel-kvmsmall-vdsoUpgrade dtb-appleUpgrade kernel-rt-extraUpgrade cluster-md-kmp-azureUpgrade dtb-socionextUpgrade kselftests-kmp-azureUpgrade kernel-azureUpgrade kernel-debug-livepatch-develUpgrade dlm-kmp-azureUpgrade kernel-macrosUpgrade kernel-64kbUpgrade reiserfs-kmp-rt | Aug 9, 2024 | May 22, 2024 |
| Ubuntu | — | No solution exists | Jun 26, 2025 | May 22, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | May 22, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub