In the Linux kernel, the following vulnerability has been resolved:
wifi: rtw89: fix race between cancel_hw_scan and hw_scan completion
The rtwdev->scanning flag isn't protected by mutex originally, so cancel_hw_scan can pass the condition, but suddenly hw_scan completion unset the flag and calls ieee80211_scan_completed() that will free local->hw_scan_req. Then, cancel_hw_scan raises null-ptr-deref and use-after-free. Fix it by moving the check condition to where protected by mutex.
KASAN: null-ptr-deref in range [0x0000000000000088-0x000000000000008f] CPU: 2 PID: 6922 Comm: kworker/2:2 Tainted: G OE Hardware name: LENOVO 2356AD1/2356AD1, BIOS G7ETB6WW (2.76 ) 09/10/2019 Workqueue: events cfg80211_conn_work [cfg80211] RIP: 0010:rtw89_fw_h2c_scan_offload_be+0xc33/0x13c3 [rtw89_core] Code: 00 45 89 6c 24 1c 0f 85 23 01 00 00 48 8b 85 20 ff ff ff 48 8d RSP: 0018:ffff88811fd9f068 EFLAGS: 00010206 RAX: dffffc0000000000 RBX: ffff88811fd9f258 RCX: 0000000000000001 RDX: 0000000000000011 RSI: 0000000000000001 RDI: 0000000000000089 RBP: ffff88811fd9f170 R08: 0000000000000000 R09: 0000000000000000 R10: ffff88811fd9f108 R11: 0000000000000000 R12: ffff88810e47f960 R13: 0000000000000000 R14: 000000000000ffff R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff8881d6f00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007531dfca55b0 CR3: 00000001be296004 CR4: 00000000001706e0 Call Trace: <TASK> ? show_regs+0x61/0x73 ? __die_body+0x20/0x73 ? die_addr+0x4f/0x7b ? exc_general_protection+0x191/0x1db ? asm_exc_general_protection+0x27/0x30 ? rtw89_fw_h2c_scan_offload_be+0xc33/0x13c3 [rtw89_core] ? rtw89_fw_h2c_scan_offload_be+0x458/0x13c3 [rtw89_core] ? __pfx_rtw89_fw_h2c_scan_offload_be+0x10/0x10 [rtw89_core] ? do_raw_spin_lock+0x75/0xdb ? __pfx_do_raw_spin_lock+0x10/0x10 rtw89_hw_scan_offload+0xb5e/0xbf7 [rtw89_core] ? _raw_spin_unlock+0xe/0x24 ? __mutex_lock.constprop.0+0x40c/0x471 ? __pfx_rtw89_hw_scan_offload+0x10/0x10 [rtw89_core] ? __mutex_lock_slowpath+0x13/0x1f ? mutex_lock+0xa2/0xdc ? __pfx_mutex_lock+0x10/0x10 rtw89_hw_scan_abort+0x58/0xb7 [rtw89_core] rtw89_ops_cancel_hw_scan+0x120/0x13b [rtw89_core] ieee80211_scan_cancel+0x468/0x4d0 [mac80211] ieee80211_prep_connection+0x858/0x899 [mac80211] ieee80211_mgd_auth+0xbea/0xdde [mac80211] ? __pfx_ieee80211_mgd_auth+0x10/0x10 [mac80211] ? cfg80211_find_elem+0x15/0x29 [cfg80211] ? is_bss+0x1b7/0x1d7 [cfg80211] ieee80211_auth+0x18/0x27 [mac80211] cfg80211_mlme_auth+0x3bb/0x3e7 [cfg80211] cfg80211_conn_do_work+0x410/0xb81 [cfg80211] ? __pfx_cfg80211_conn_do_work+0x10/0x10 [cfg80211] ? __kasan_check_read+0x11/0x1f ? psi_group_change+0x8bc/0x944 ? __kasan_check_write+0x14/0x22 ? mutex_lock+0x8e/0xdc ? __pfx_mutex_lock+0x10/0x10 ? __pfx___radix_tree_lookup+0x10/0x10 cfg80211_conn_work+0x245/0x34d [cfg80211] ? __pfx_cfg80211_conn_work+0x10/0x10 [cfg80211] ? update_cfs_rq_load_avg+0x3bc/0x3d7 ? sched_clock_noinstr+0x9/0x1a ? sched_clock+0x10/0x24 ? sched_clock_cpu+0x7e/0x42e ? newidle_balance+0x796/0x937 ? __pfx_sched_clock_cpu+0x10/0x10 ? __pfx_newidle_balance+0x10/0x10 ? __kasan_check_read+0x11/0x1f ? psi_group_change+0x8bc/0x944 ? _raw_spin_unlock+0xe/0x24 ? raw_spin_rq_unlock+0x47/0x54 ? raw_spin_rq_unlock_irq+0x9/0x1f ? finish_task_switch.isra.0+0x347/0x586 ? __schedule+0x27bf/0x2892 ? mutex_unlock+0x80/0xd0 ? do_raw_spin_lock+0x75/0xdb ? __pfx___schedule+0x10/0x10 process_scheduled_works+0x58c/0x821 worker_thread+0x4c7/0x586 ? __kasan_check_read+0x11/0x1f kthread+0x285/0x294 ? __pfx_worker_thread+0x10/0x10 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x29/0x6f ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1b/0x30 </TASK>
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade kernel-tools-libs-develUpgrade kernel-zfcpdump-modulesUpgrade rvUpgrade kernel-zfcpdump-coreUpgrade libperfUpgrade kernel-debug-devel-matchedUpgrade kernel-64k-debug-devel-matchedUpgrade kernel-rt-64k-debug-coreUpgrade kernel-cross-headersUpgrade kernel-docUpgrade kernel-rt-debug-develUpgrade kernel-rt-64k-debugUpgrade kernel-abi-stablelistsUpgrade kernel-uki-virt-addonsUpgrade kernel-zfcpdump-modules-coreUpgrade kernel-64k-debugUpgrade kernel-rt-modules-coreUpgrade kernel-64k-modulesUpgrade kernelUpgrade kernel-devel-matchedUpgrade kernel-rt-64k-modulesUpgrade kernel-rt-64k-debug-modulesUpgrade kernel-rt-debug-modules-extraUpgrade kernel-modules-coreUpgrade kernel-rt-64kUpgrade kernel-64k-coreUpgrade kernel-toolsUpgrade kernel-zfcpdump-develUpgrade kernel-64k-debug-modules-extraUpgrade kernel-rt-64k-modules-extraUpgrade kernel-rtUpgrade kernel-64k-devel-matchedUpgrade kernel-rt-64k-modules-coreUpgrade kernel-headersUpgrade kernel-debug-modules-extraUpgrade kernel-uki-virtUpgrade kernel-debug-coreUpgrade rtlaUpgrade kernel-modules-extraUpgrade kernel-develUpgrade kernel-coreUpgrade kernel-rt-modulesUpgrade kernel-rt-modules-extraUpgrade kernel-rt-debugUpgrade perfUpgrade kernel-64k-debug-coreUpgrade kernel-rt-debug-coreUpgrade kernel-64k-debug-modules-coreUpgrade kernel-64k-modules-extraUpgrade kernel-rt-64k-debug-develUpgrade kernel-rt-64k-develUpgrade kernel-debug-modulesUpgrade kernel-64k-develUpgrade kernel-64k-modules-coreUpgrade kernel-debugUpgrade kernel-debug-modules-coreUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-64kUpgrade kernel-rt-coreUpgrade kernel-tools-libsUpgrade kernel-rt-debug-modules-coreUpgrade kernel-zfcpdumpUpgrade kernel-rt-develUpgrade kernel-64k-debug-modulesUpgrade kernel-rt-64k-debug-modules-extraUpgrade kernel-rt-64k-debug-modules-coreUpgrade kernel-64k-debug-develUpgrade python3-perfUpgrade kernel-rt-64k-coreUpgrade kernel-debug-uki-virtUpgrade kernel-zfcpdump-devel-matchedUpgrade kernel-modulesUpgrade kernel-rt-debug-modulesUpgrade kernel-debug-devel | Nov 20, 2025 | Nov 11, 2025 |
| Debian | — | Upgrade linux | May 15, 2025 | Feb 27, 2025 |
| Oracle_linux | — | Upgrade kernel | Nov 28, 2025 | Feb 27, 2025 |
| Redhat_linux | — | Upgrade kernelNo solution existsUpgrade kernel-rt | Jul 9, 2025 | Feb 27, 2025 |
| Rocky_linux | — | Upgrade kernel-zfcpdump-coreUpgrade kernel-debuginfo-common-s390xUpgrade kernel-rt-debuginfoUpgrade kernel-zfcpdump-devel-matchedUpgrade kernel-rtUpgrade kernel-rt-develUpgrade kernel-rt-modules-coreUpgrade kernelUpgrade kernel-rt-modulesUpgrade python3-perf-debuginfoUpgrade kernel-debug-modules-extraUpgrade kernel-tools-libs-develUpgrade kernel-uki-virt-addonsUpgrade kernel-rt-debug-coreUpgrade kernel-zfcpdump-modules-coreUpgrade kernel-rt-debug-debuginfoUpgrade kernel-rt-modules-extraUpgrade kernel-zfcpdump-modulesUpgrade libperf-debuginfoUpgrade kernel-toolsUpgrade rvUpgrade kernel-debug-devel-matchedUpgrade kernel-zfcpdump-debuginfoUpgrade kernel-debug-coreUpgrade perfUpgrade kernel-debuginfoUpgrade kernel-debug-uki-virtUpgrade python3-perfUpgrade kernel-debug-modules-coreUpgrade kernel-tools-libsUpgrade kernel-develUpgrade kernel-uki-virtUpgrade kernel-zfcpdump-develUpgrade kernel-debug-modulesUpgrade kernel-modules-extraUpgrade kernel-debugUpgrade kernel-rt-coreUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-rt-debug-modules-extraUpgrade kernel-tools-debuginfoUpgrade rtlaUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-modules-coreUpgrade kernel-coreUpgrade kernel-rt-debug-modulesUpgrade kernel-modulesUpgrade kernel-debug-debuginfoUpgrade kernel-devel-matchedUpgrade kernel-rt-debug-modules-coreUpgrade kernel-rt-debugUpgrade libperfUpgrade perf-debuginfoUpgrade kernel-debug-develUpgrade kernel-zfcpdumpUpgrade kernel-rt-debug-devel | Feb 5, 2026 | Nov 21, 2025 |
| Suse | — | Upgrade ocfs2-kmp-rtUpgrade dtb-nvidiaUpgrade kernel-64kb-develUpgrade kernel-rt-develUpgrade kernel-rtUpgrade kernel-obs-qaUpgrade dtb-rockchipUpgrade kselftests-kmp-64kbUpgrade dtb-xilinxUpgrade ocfs2-kmp-azureUpgrade kernel-develUpgrade dtb-caviumUpgrade kernel-docsUpgrade gfs2-kmp-rtUpgrade kernel-sourceUpgrade kernel-devel-rtUpgrade dtb-hisiliconUpgrade dlm-kmp-rtUpgrade reiserfs-kmp-defaultUpgrade kselftests-kmp-defaultUpgrade kernel-syms-azureUpgrade kernel-devel-azureUpgrade dtb-apmUpgrade cluster-md-kmp-rtUpgrade dtb-allwinnerUpgrade kernel-default-vdsoUpgrade gfs2-kmp-azureUpgrade reiserfs-kmp-azureUpgrade dlm-kmp-azureUpgrade ocfs2-kmp-defaultUpgrade kernel-debugUpgrade dtb-mediatekUpgrade kernel-default-optionalUpgrade kernel-defaultUpgrade kernel-zfcpdumpUpgrade gfs2-kmp-64kbUpgrade kernel-default-extraUpgrade kernel-symsUpgrade kernel-default-base-rebuildUpgrade dtb-armUpgrade dtb-exynosUpgrade dtb-qcomUpgrade kernel-default-develUpgrade kernel-kvmsmall-develUpgrade dlm-kmp-defaultUpgrade dtb-sprdUpgrade dtb-socionextUpgrade kselftests-kmp-azureUpgrade kernel-rt_debug-vdsoUpgrade kselftests-kmp-rtUpgrade kernel-syms-rtUpgrade kernel-kvmsmall-vdsoUpgrade dtb-broadcomUpgrade dtb-amazonUpgrade dtb-amlogicUpgrade kernel-default-livepatchUpgrade kernel-default-livepatch-develUpgrade kernel-azure-extraUpgrade gfs2-kmp-defaultUpgrade kernel-rt-optionalUpgrade kernel-kvmsmallUpgrade kernel-source-vanillaUpgrade kernel-source-rtUpgrade kernel-azure-optionalUpgrade dtb-renesasUpgrade kernel-64kb-optionalUpgrade dtb-amdUpgrade dlm-kmp-64kbUpgrade cluster-md-kmp-azureUpgrade cluster-md-kmp-defaultUpgrade kernel-rt-extraUpgrade kernel-obs-buildUpgrade dtb-freescaleUpgrade reiserfs-kmp-rtUpgrade kernel-rt_debug-develUpgrade kernel-rt_debugUpgrade kernel-debug-vdsoUpgrade kernel-64kb-extraUpgrade kernel-source-azureUpgrade kernel-rt-livepatch-develUpgrade kernel-default-baseUpgrade kernel-azure-vdsoUpgrade dtb-appleUpgrade cluster-md-kmp-64kbUpgrade kernel-debug-develUpgrade kernel-azureUpgrade kernel-64kbUpgrade reiserfs-kmp-64kbUpgrade dtb-alteraUpgrade dtb-marvellUpgrade dtb-lgUpgrade ocfs2-kmp-64kbUpgrade kernel-rt-vdsoUpgrade kernel-docs-htmlUpgrade kernel-azure-develUpgrade kernel-macros | May 26, 2025 | Feb 27, 2025 |
| Ubuntu | — | Upgrade linux-image-generic-hwe-22.04Upgrade linux-image-oracle-lts-24.04Upgrade linux-image-virtualUpgrade linux-image-lowlatencyUpgrade linux-image-azure-lts-24.04Upgrade linux-image-ibm-lts-24.04Upgrade linux-image-nvidia-lowlatency-64kUpgrade linux-image-lowlatency-64kUpgrade linux-image-generic-64k-hwe-22.04Upgrade linux-image-oem-22.04aUpgrade linux-image-gkeUpgrade linux-image-oracle-64kUpgrade linux-image-6.8.0-1029-azure-nvidiaUpgrade linux-image-raspi-realtimeUpgrade linux-image-xilinxUpgrade linux-image-6.8.0-88-fipsUpgrade linux-image-nvidia-lowlatency-64k-6.8Upgrade linux-image-6.8.0-1040-gke-64kUpgrade linux-image-6.8.0-1043-raspiUpgrade linux-image-azure-6.8Upgrade linux-image-nvidia-hwe-22.04Upgrade linux-image-lowlatency-64k-6.8Upgrade linux-image-lowlatency-hwe-22.04Upgrade linux-image-6.8.0-88-lowlatencyUpgrade linux-image-6.8.0-88-genericUpgrade linux-image-aws-64kUpgrade linux-image-gcpUpgrade linux-image-gcp-6.8Upgrade linux-image-azure-fips-6.8Upgrade linux-image-fipsUpgrade linux-image-gkeop-6.8Upgrade linux-image-6.8.0-1044-gcp-fipsUpgrade linux-image-ibm-6.8Upgrade linux-image-6.8.0-88-generic-64kUpgrade linux-image-kvmUpgrade linux-image-6.8.0-1043-nvidiaUpgrade linux-image-nvidia-64k-6.8Upgrade linux-image-nvidia-64kUpgrade linux-image-fips-6.8Upgrade linux-image-6.8.0-1041-ibmUpgrade linux-image-6.8.0-88-lowlatency-64kUpgrade linux-image-6.8.0-1044-gcp-64kUpgrade linux-image-ibmUpgrade linux-image-oem-22.04Upgrade linux-image-realtimeUpgrade linux-image-lowlatency-64k-hwe-22.04Upgrade linux-image-oracleUpgrade linux-image-generic-lpaeUpgrade linux-image-6.8.0-1043-aws-fipsUpgrade linux-image-gcp-64k-lts-24.04Upgrade linux-image-6.8.0-1040-oracle-64kUpgrade linux-image-awsUpgrade linux-image-6.8.0-1043-nvidia-64kUpgrade linux-image-aws-64k-6.8Upgrade linux-image-ibm-classicUpgrade linux-image-nvidia-lowlatency-6.8Upgrade linux-image-nvidia-64k-hwe-22.04Upgrade linux-image-oem-22.04bUpgrade linux-image-generic-6.8Upgrade linux-image-6.8.0-1044-azure-fipsUpgrade linux-image-6.8.0-1043-aws-64kUpgrade linux-image-aws-64k-lts-24.04Upgrade linux-image-oem-22.04cUpgrade linux-image-gcp-fips-6.8Upgrade linux-image-aws-6.8Upgrade linux-image-raspiUpgrade linux-image-realtime-6.8.1Upgrade linux-image-gke-6.8Upgrade linux-image-gcp-fipsUpgrade linux-image-raspi-realtime-6.8Upgrade linux-image-virtual-hwe-22.04Upgrade linux-image-6.8.0-1043-awsUpgrade linux-image-genericUpgrade linux-image-azure-nvidia-lts-24.04Upgrade linux-image-6.8.0-1040-oracleUpgrade linux-image-nvidiaUpgrade linux-image-gkeopUpgrade linux-image-generic-64kUpgrade linux-image-oracle-64k-6.8Upgrade linux-image-gcp-lts-24.04Upgrade linux-image-xilinx-zynqmpUpgrade linux-image-6.8.0-1043-nvidia-lowlatency-64kUpgrade linux-image-aws-fipsUpgrade linux-image-nvidia-lowlatencyUpgrade linux-image-6.8.0-1020-xilinxUpgrade linux-image-6.8.0-1040-gkeUpgrade linux-image-6.8.0-1044-azureUpgrade linux-image-6.8.0-2034-raspi-realtimeUpgrade linux-image-gcp-64k-6.8Upgrade linux-image-nvidia-6.8Upgrade linux-image-virtual-6.8Upgrade linux-image-oracle-6.8Upgrade linux-image-azure-fipsUpgrade linux-image-6.8.0-1044-gcpUpgrade linux-image-aws-lts-24.04Upgrade linux-image-oracle-64k-lts-24.04Upgrade linux-image-azure-nvidia-6.8Upgrade linux-image-aws-fips-6.8Upgrade linux-image-oem-22.04dUpgrade linux-image-6.8.0-1043-nvidia-lowlatencyUpgrade linux-image-gke-64k-6.8Upgrade linux-image-gke-64kUpgrade linux-image-azureUpgrade linux-image-6.8.0-1027-gkeopUpgrade linux-image-gcp-64kUpgrade linux-image-lowlatency-6.8Upgrade linux-image-generic-64k-6.8Upgrade linux-image-xilinx-6.8Upgrade linux-image-6.8.1-1038-realtimeUpgrade linux-image-raspi-6.8 | Jun 26, 2025 | Feb 27, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub