In the Linux kernel, the following vulnerability has been resolved:
drivers: staging: rtl8723bs: Fix locking in _rtw_join_timeout_handler()
Commit 041879b12ddb ("drivers: staging: rtl8192bs: Fix deadlock in rtw_joinbss_event_prehandle()") besides fixing the deadlock also modified _rtw_join_timeout_handler() to use spin_[un]lock_irq() instead of spin_[un]lock_bh().
_rtw_join_timeout_handler() calls rtw_do_join() which takes pmlmepriv->scanned_queue.lock using spin_[un]lock_bh(). This spin_unlock_bh() call re-enables softirqs which triggers an oops in kernel/softirq.c: __local_bh_enable_ip() when it calls lockdep_assert_irqs_enabled():
[ 244.506087] WARNING: CPU: 2 PID: 0 at kernel/softirq.c:376 __local_bh_enable_ip+0xa6/0x100 ... [ 244.509022] Call Trace: [ 244.509048] <IRQ> [ 244.509100] _rtw_join_timeout_handler+0x134/0x170 [r8723bs] [ 244.509468] ? __pfx__rtw_join_timeout_handler+0x10/0x10 [r8723bs] [ 244.509772] ? __pfx__rtw_join_timeout_handler+0x10/0x10 [r8723bs] [ 244.510076] call_timer_fn+0x95/0x2a0 [ 244.510200] __run_timers.part.0+0x1da/0x2d0
This oops is causd by the switch to spin_[un]lock_irq() which disables the IRQs for the entire duration of _rtw_join_timeout_handler().
Disabling the IRQs is not necessary since all code taking this lock runs from either user contexts or from softirqs, switch back to spin_[un]lock_bh() to fix this.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux | Sep 18, 2025 | Sep 18, 2025 |
| Ubuntu | — | Upgrade linux-nvidiaUpgrade linux-aws-5.15Upgrade linux-azure-5.15Upgrade linux-lowlatencyUpgrade linux-gkeUpgrade linux-realtimeUpgrade linux-nvidia-tegra-5.15Upgrade linux-lowlatency-hwe-5.15Upgrade linux-gkeopUpgrade linux-hwe-5.15Upgrade linux-oracle-5.15Upgrade linux-gcp-5.15Upgrade linux-intel-iotg-5.15Upgrade linux-raspiUpgrade linux-xilinx-zynqmpUpgrade linuxUpgrade linux-azureUpgrade linux-nvidia-tegraUpgrade linux-riscv-5.15Upgrade linux-kvmUpgrade linux-oracleUpgrade linux-intel-iotgUpgrade linux-gcpUpgrade linux-bluefieldUpgrade linux-ibm-5.15Upgrade linux-nvidia-tegra-igxUpgrade linux-ibmUpgrade linux-awsUpgrade linux-intel-iot-realtime | Sep 19, 2025 | Sep 17, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub