In the Linux kernel, the following vulnerability has been resolved:
wifi: rtw89: fix race between cancel_hw_scan and hw_scan completion
The rtwdev->scanning flag isn't protected by mutex originally, so cancel_hw_scan can pass the condition, but suddenly hw_scan completion unset the flag and calls ieee80211_scan_completed() that will free local->hw_scan_req. Then, cancel_hw_scan raises null-ptr-deref and use-after-free. Fix it by moving the check condition to where protected by mutex.
KASAN: null-ptr-deref in range [0x0000000000000088-0x000000000000008f] CPU: 2 PID: 6922 Comm: kworker/2:2 Tainted: G OE Hardware name: LENOVO 2356AD1/2356AD1, BIOS G7ETB6WW (2.76 ) 09/10/2019 Workqueue: events cfg80211_conn_work [cfg80211] RIP: 0010:rtw89_fw_h2c_scan_offload_be+0xc33/0x13c3 [rtw89_core] Code: 00 45 89 6c 24 1c 0f 85 23 01 00 00 48 8b 85 20 ff ff ff 48 8d RSP: 0018:ffff88811fd9f068 EFLAGS: 00010206 RAX: dffffc0000000000 RBX: ffff88811fd9f258 RCX: 0000000000000001 RDX: 0000000000000011 RSI: 0000000000000001 RDI: 0000000000000089 RBP: ffff88811fd9f170 R08: 0000000000000000 R09: 0000000000000000 R10: ffff88811fd9f108 R11: 0000000000000000 R12: ffff88810e47f960 R13: 0000000000000000 R14: 000000000000ffff R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff8881d6f00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007531dfca55b0 CR3: 00000001be296004 CR4: 00000000001706e0 Call Trace: <TASK> ? show_regs+0x61/0x73 ? __die_body+0x20/0x73 ? die_addr+0x4f/0x7b ? exc_general_protection+0x191/0x1db ? asm_exc_general_protection+0x27/0x30 ? rtw89_fw_h2c_scan_offload_be+0xc33/0x13c3 [rtw89_core] ? rtw89_fw_h2c_scan_offload_be+0x458/0x13c3 [rtw89_core] ? __pfx_rtw89_fw_h2c_scan_offload_be+0x10/0x10 [rtw89_core] ? do_raw_spin_lock+0x75/0xdb ? __pfx_do_raw_spin_lock+0x10/0x10 rtw89_hw_scan_offload+0xb5e/0xbf7 [rtw89_core] ? _raw_spin_unlock+0xe/0x24 ? __mutex_lock.constprop.0+0x40c/0x471 ? __pfx_rtw89_hw_scan_offload+0x10/0x10 [rtw89_core] ? __mutex_lock_slowpath+0x13/0x1f ? mutex_lock+0xa2/0xdc ? __pfx_mutex_lock+0x10/0x10 rtw89_hw_scan_abort+0x58/0xb7 [rtw89_core] rtw89_ops_cancel_hw_scan+0x120/0x13b [rtw89_core] ieee80211_scan_cancel+0x468/0x4d0 [mac80211] ieee80211_prep_connection+0x858/0x899 [mac80211] ieee80211_mgd_auth+0xbea/0xdde [mac80211] ? __pfx_ieee80211_mgd_auth+0x10/0x10 [mac80211] ? cfg80211_find_elem+0x15/0x29 [cfg80211] ? is_bss+0x1b7/0x1d7 [cfg80211] ieee80211_auth+0x18/0x27 [mac80211] cfg80211_mlme_auth+0x3bb/0x3e7 [cfg80211] cfg80211_conn_do_work+0x410/0xb81 [cfg80211] ? __pfx_cfg80211_conn_do_work+0x10/0x10 [cfg80211] ? __kasan_check_read+0x11/0x1f ? psi_group_change+0x8bc/0x944 ? __kasan_check_write+0x14/0x22 ? mutex_lock+0x8e/0xdc ? __pfx_mutex_lock+0x10/0x10 ? __pfx___radix_tree_lookup+0x10/0x10 cfg80211_conn_work+0x245/0x34d [cfg80211] ? __pfx_cfg80211_conn_work+0x10/0x10 [cfg80211] ? update_cfs_rq_load_avg+0x3bc/0x3d7 ? sched_clock_noinstr+0x9/0x1a ? sched_clock+0x10/0x24 ? sched_clock_cpu+0x7e/0x42e ? newidle_balance+0x796/0x937 ? __pfx_sched_clock_cpu+0x10/0x10 ? __pfx_newidle_balance+0x10/0x10 ? __kasan_check_read+0x11/0x1f ? psi_group_change+0x8bc/0x944 ? _raw_spin_unlock+0xe/0x24 ? raw_spin_rq_unlock+0x47/0x54 ? raw_spin_rq_unlock_irq+0x9/0x1f ? finish_task_switch.isra.0+0x347/0x586 ? __schedule+0x27bf/0x2892 ? mutex_unlock+0x80/0xd0 ? do_raw_spin_lock+0x75/0xdb ? __pfx___schedule+0x10/0x10 process_scheduled_works+0x58c/0x821 worker_thread+0x4c7/0x586 ? __kasan_check_read+0x11/0x1f kthread+0x285/0x294 ? __pfx_worker_thread+0x10/0x10 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x29/0x6f ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1b/0x30 </TASK>
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade kernel-rt-64k-coreUpgrade kernel-debug-uki-virtUpgrade kernel-debug-coreUpgrade kernel-debug-modulesUpgrade kernel-tools-libsUpgrade kernel-rt-64k-debug-modules-extraUpgrade kernel-64k-debug-modulesUpgrade kernel-64k-develUpgrade kernel-debugUpgrade rtlaUpgrade kernel-debug-develUpgrade perfUpgrade kernel-modulesUpgrade kernel-rt-debug-modulesUpgrade kernel-zfcpdump-devel-matchedUpgrade kernel-64kUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-zfcpdumpUpgrade kernel-rt-64k-debug-develUpgrade kernel-rt-debugUpgrade kernel-rt-64k-develUpgrade kernel-coreUpgrade kernel-develUpgrade kernel-rt-debug-coreUpgrade kernel-rt-modules-extraUpgrade kernel-64k-debug-coreUpgrade kernel-modules-extraUpgrade kernel-64k-modules-coreUpgrade kernel-64k-modules-extraUpgrade kernel-64k-debug-modules-coreUpgrade kernel-rt-coreUpgrade kernel-debug-modules-coreUpgrade kernel-rt-64k-debug-modules-coreUpgrade kernel-rt-modulesUpgrade python3-perfUpgrade kernel-rt-debug-modules-coreUpgrade kernel-64k-debug-develUpgrade kernel-rt-develUpgrade kernel-uki-virt-addonsUpgrade kernel-modules-coreUpgrade kernel-tools-libs-develUpgrade kernel-devel-matchedUpgrade kernel-toolsUpgrade kernel-rt-debug-modules-extraUpgrade kernel-rt-modules-coreUpgrade kernel-docUpgrade kernel-zfcpdump-develUpgrade kernel-debug-devel-matchedUpgrade kernel-rt-64k-modulesUpgrade kernel-debug-modules-extraUpgrade kernel-rt-64kUpgrade kernelUpgrade kernel-rt-debug-develUpgrade kernel-cross-headersUpgrade kernel-64k-debugUpgrade kernel-64k-debug-devel-matchedUpgrade kernel-rt-64k-debug-modulesUpgrade kernel-rt-64k-modules-extraUpgrade libperfUpgrade kernel-64k-debug-modules-extraUpgrade rvUpgrade kernel-zfcpdump-modules-coreUpgrade kernel-64k-modulesUpgrade kernel-rt-64k-debug-coreUpgrade kernel-rt-64k-modules-coreUpgrade kernel-64k-coreUpgrade kernel-rtUpgrade kernel-headersUpgrade kernel-abi-stablelistsUpgrade kernel-64k-devel-matchedUpgrade kernel-rt-64k-debugUpgrade kernel-zfcpdump-coreUpgrade kernel-zfcpdump-modulesUpgrade kernel-uki-virt | Nov 20, 2025 | Nov 11, 2025 |
| Debian | — | Upgrade linux | May 15, 2025 | Feb 27, 2025 |
| Oracle_linux | — | Upgrade kernel | Nov 28, 2025 | Feb 27, 2025 |
| Redhat_linux | — | Upgrade kernelNo solution existsUpgrade kernel-rt | Jul 9, 2025 | Feb 27, 2025 |
| Rocky_linux | — | Upgrade kernel-coreUpgrade perf-debuginfoUpgrade kernel-modules-coreUpgrade kernel-debug-develUpgrade kernel-zfcpdump-develUpgrade perfUpgrade kernel-debug-coreUpgrade kernel-debuginfoUpgrade kernel-modules-extraUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-rt-debug-modules-extraUpgrade kernel-debugUpgrade kernel-debug-modulesUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-tools-debuginfoUpgrade rtlaUpgrade kernel-rt-debugUpgrade kernel-rt-debug-modules-coreUpgrade libperfUpgrade kernel-modulesUpgrade kernel-tools-libsUpgrade kernel-uki-virtUpgrade kernel-develUpgrade kernel-debug-debuginfoUpgrade kernel-debug-modules-coreUpgrade kernel-debug-uki-virtUpgrade kernel-devel-matchedUpgrade kernel-rt-debug-modulesUpgrade kernel-rt-debug-develUpgrade kernel-zfcpdumpUpgrade kernel-rt-coreUpgrade python3-perfUpgrade kernel-rt-modules-extraUpgrade kernel-zfcpdump-devel-matchedUpgrade rvUpgrade kernel-rt-debuginfoUpgrade kernel-rt-debug-coreUpgrade kernel-zfcpdump-modules-coreUpgrade kernel-rt-modules-coreUpgrade kernel-rt-develUpgrade libperf-debuginfoUpgrade kernel-rt-debug-debuginfoUpgrade kernel-rtUpgrade kernel-rt-modulesUpgrade python3-perf-debuginfoUpgrade kernel-toolsUpgrade kernel-zfcpdump-modulesUpgrade kernel-uki-virt-addonsUpgrade kernel-tools-libs-develUpgrade kernel-debug-modules-extraUpgrade kernel-zfcpdump-debuginfoUpgrade kernel-debug-devel-matchedUpgrade kernelUpgrade kernel-debuginfo-common-s390xUpgrade kernel-zfcpdump-core | Feb 5, 2026 | Nov 21, 2025 |
| Suse | — | Upgrade kernel-azureUpgrade cluster-md-kmp-azureUpgrade kernel-64kbUpgrade cluster-md-kmp-defaultUpgrade cluster-md-kmp-64kbUpgrade dtb-appleUpgrade kernel-debug-develUpgrade dlm-kmp-64kbUpgrade kernel-docs-htmlUpgrade kernel-default-baseUpgrade kernel-rt-livepatch-develUpgrade kernel-source-azureUpgrade dtb-amdUpgrade dtb-renesasUpgrade kernel-64kb-extraUpgrade dtb-freescaleUpgrade kernel-debug-vdsoUpgrade kernel-azure-vdsoUpgrade kernel-azure-optionalUpgrade kernel-obs-buildUpgrade kernel-64kb-optionalUpgrade kernel-rt-extraUpgrade kernel-rt_debugUpgrade kernel-rt_debug-develUpgrade dtb-sprdUpgrade kselftests-kmp-azureUpgrade dlm-kmp-defaultUpgrade ocfs2-kmp-64kbUpgrade dtb-marvellUpgrade kernel-azure-develUpgrade kernel-rt-vdsoUpgrade dtb-amlogicUpgrade dtb-amazonUpgrade reiserfs-kmp-64kbUpgrade dtb-broadcomUpgrade kernel-default-livepatchUpgrade dtb-socionextUpgrade kernel-kvmsmall-develUpgrade kernel-source-vanillaUpgrade gfs2-kmp-defaultUpgrade kernel-azure-extraUpgrade kernel-kvmsmall-vdsoUpgrade kernel-default-livepatch-develUpgrade kernel-kvmsmallUpgrade kernel-rt_debug-vdsoUpgrade kernel-rt-optionalUpgrade kernel-macrosUpgrade kernel-default-develUpgrade kernel-source-rtUpgrade kernel-syms-rtUpgrade dtb-lgUpgrade dtb-alteraUpgrade kselftests-kmp-rtUpgrade reiserfs-kmp-rtUpgrade kernel-default-vdsoUpgrade kselftests-kmp-64kbUpgrade dtb-nvidiaUpgrade reiserfs-kmp-defaultUpgrade kernel-64kb-develUpgrade kernel-obs-qaUpgrade kernel-rtUpgrade kernel-rt-develUpgrade ocfs2-kmp-azureUpgrade ocfs2-kmp-defaultUpgrade kernel-syms-azureUpgrade kernel-devel-azureUpgrade dtb-apmUpgrade dlm-kmp-azureUpgrade reiserfs-kmp-azureUpgrade gfs2-kmp-64kbUpgrade gfs2-kmp-azureUpgrade dtb-xilinxUpgrade dtb-allwinnerUpgrade cluster-md-kmp-rtUpgrade dtb-exynosUpgrade kernel-default-base-rebuildUpgrade dtb-qcomUpgrade dtb-armUpgrade dlm-kmp-rtUpgrade kernel-sourceUpgrade kernel-devel-rtUpgrade gfs2-kmp-rtUpgrade dtb-hisiliconUpgrade ocfs2-kmp-rtUpgrade kernel-docsUpgrade dtb-caviumUpgrade dtb-mediatekUpgrade kernel-default-optionalUpgrade kernel-symsUpgrade kernel-default-extraUpgrade kernel-defaultUpgrade kernel-debugUpgrade kernel-zfcpdumpUpgrade kernel-develUpgrade kselftests-kmp-defaultUpgrade dtb-rockchip | May 26, 2025 | Feb 27, 2025 |
| Ubuntu | — | Upgrade linux-image-virtualUpgrade linux-image-lowlatency-64kUpgrade linux-image-6.8.0-1041-ibmUpgrade linux-image-oem-22.04Upgrade linux-image-azure-lts-24.04Upgrade linux-image-6.8.0-1043-nvidiaUpgrade linux-image-6.8.0-88-generic-64kUpgrade linux-image-nvidia-64k-6.8Upgrade linux-image-fips-6.8Upgrade linux-image-nvidia-64kUpgrade linux-image-kvmUpgrade linux-image-oem-22.04aUpgrade linux-image-generic-6.8Upgrade linux-image-ibm-lts-24.04Upgrade linux-image-6.8.0-1043-nvidia-64kUpgrade linux-image-gkeop-6.8Upgrade linux-image-lowlatency-64k-hwe-22.04Upgrade linux-image-nvidia-lowlatency-6.8Upgrade linux-image-oem-22.04bUpgrade linux-image-6.8.0-1029-azure-nvidiaUpgrade linux-image-6.8.0-1044-gcp-fipsUpgrade linux-image-awsUpgrade linux-image-ibm-6.8Upgrade linux-image-azure-6.8Upgrade linux-image-fipsUpgrade linux-image-azure-fips-6.8Upgrade linux-image-generic-64k-hwe-22.04Upgrade linux-image-oracleUpgrade linux-image-6.8.0-1043-aws-fipsUpgrade linux-image-generic-lpaeUpgrade linux-image-generic-hwe-22.04Upgrade linux-image-nvidia-64k-hwe-22.04Upgrade linux-image-gcp-64k-lts-24.04Upgrade linux-image-realtimeUpgrade linux-image-oracle-64kUpgrade linux-image-6.8.0-88-fipsUpgrade linux-image-6.8.0-88-lowlatencyUpgrade linux-image-oracle-lts-24.04Upgrade linux-image-nvidia-lowlatency-64kUpgrade linux-image-aws-64k-6.8Upgrade linux-image-ibm-classicUpgrade linux-image-6.8.0-1040-oracle-64kUpgrade linux-image-lowlatencyUpgrade linux-image-gkeUpgrade linux-image-lowlatency-hwe-22.04Upgrade linux-image-ibmUpgrade linux-image-nvidia-lowlatency-64k-6.8Upgrade linux-image-nvidia-hwe-22.04Upgrade linux-image-6.8.0-88-genericUpgrade linux-image-6.8.0-1044-gcp-64kUpgrade linux-image-aws-64kUpgrade linux-image-lowlatency-64k-6.8Upgrade linux-image-gcpUpgrade linux-image-xilinxUpgrade linux-image-6.8.0-1040-gke-64kUpgrade linux-image-raspi-realtimeUpgrade linux-image-6.8.0-1043-raspiUpgrade linux-image-6.8.0-88-lowlatency-64kUpgrade linux-image-gcp-6.8Upgrade linux-image-generic-64k-6.8Upgrade linux-image-gke-64k-6.8Upgrade linux-image-raspi-6.8Upgrade linux-image-nvidiaUpgrade linux-image-aws-fipsUpgrade linux-image-6.8.0-1043-nvidia-lowlatency-64kUpgrade linux-image-generic-64kUpgrade linux-image-xilinx-6.8Upgrade linux-image-aws-64k-lts-24.04Upgrade linux-image-gcp-64kUpgrade linux-image-6.8.1-1038-realtimeUpgrade linux-image-oem-22.04cUpgrade linux-image-6.8.0-1043-aws-64kUpgrade linux-image-nvidia-6.8Upgrade linux-image-realtime-6.8.1Upgrade linux-image-oem-22.04dUpgrade linux-image-genericUpgrade linux-image-6.8.0-1043-awsUpgrade linux-image-azure-fipsUpgrade linux-image-oracle-64k-lts-24.04Upgrade linux-image-azure-nvidia-6.8Upgrade linux-image-aws-fips-6.8Upgrade linux-image-aws-lts-24.04Upgrade linux-image-raspiUpgrade linux-image-azure-nvidia-lts-24.04Upgrade linux-image-gcp-64k-6.8Upgrade linux-image-gcp-lts-24.04Upgrade linux-image-6.8.0-1044-azure-fipsUpgrade linux-image-6.8.0-1040-gkeUpgrade linux-image-6.8.0-1044-azureUpgrade linux-image-gke-6.8Upgrade linux-image-6.8.0-1040-oracleUpgrade linux-image-6.8.0-1043-nvidia-lowlatencyUpgrade linux-image-virtual-6.8Upgrade linux-image-oracle-6.8Upgrade linux-image-6.8.0-1044-gcpUpgrade linux-image-6.8.0-2034-raspi-realtimeUpgrade linux-image-azureUpgrade linux-image-xilinx-zynqmpUpgrade linux-image-gcp-fipsUpgrade linux-image-raspi-realtime-6.8Upgrade linux-image-gkeopUpgrade linux-image-oracle-64k-6.8Upgrade linux-image-virtual-hwe-22.04Upgrade linux-image-gke-64kUpgrade linux-image-gcp-fips-6.8Upgrade linux-image-aws-6.8Upgrade linux-image-6.8.0-1027-gkeopUpgrade linux-image-nvidia-lowlatencyUpgrade linux-image-lowlatency-6.8Upgrade linux-image-6.8.0-1020-xilinx | Jun 26, 2025 | Feb 27, 2025 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub