In the Linux kernel, the following vulnerability has been resolved:
wifi: rtw89: fix race between cancel_hw_scan and hw_scan completion
The rtwdev->scanning flag isn't protected by mutex originally, so cancel_hw_scan can pass the condition, but suddenly hw_scan completion unset the flag and calls ieee80211_scan_completed() that will free local->hw_scan_req. Then, cancel_hw_scan raises null-ptr-deref and use-after-free. Fix it by moving the check condition to where protected by mutex.
KASAN: null-ptr-deref in range [0x0000000000000088-0x000000000000008f] CPU: 2 PID: 6922 Comm: kworker/2:2 Tainted: G OE Hardware name: LENOVO 2356AD1/2356AD1, BIOS G7ETB6WW (2.76 ) 09/10/2019 Workqueue: events cfg80211_conn_work [cfg80211] RIP: 0010:rtw89_fw_h2c_scan_offload_be+0xc33/0x13c3 [rtw89_core] Code: 00 45 89 6c 24 1c 0f 85 23 01 00 00 48 8b 85 20 ff ff ff 48 8d RSP: 0018:ffff88811fd9f068 EFLAGS: 00010206 RAX: dffffc0000000000 RBX: ffff88811fd9f258 RCX: 0000000000000001 RDX: 0000000000000011 RSI: 0000000000000001 RDI: 0000000000000089 RBP: ffff88811fd9f170 R08: 0000000000000000 R09: 0000000000000000 R10: ffff88811fd9f108 R11: 0000000000000000 R12: ffff88810e47f960 R13: 0000000000000000 R14: 000000000000ffff R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff8881d6f00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007531dfca55b0 CR3: 00000001be296004 CR4: 00000000001706e0 Call Trace: <TASK> ? show_regs+0x61/0x73 ? __die_body+0x20/0x73 ? die_addr+0x4f/0x7b ? exc_general_protection+0x191/0x1db ? asm_exc_general_protection+0x27/0x30 ? rtw89_fw_h2c_scan_offload_be+0xc33/0x13c3 [rtw89_core] ? rtw89_fw_h2c_scan_offload_be+0x458/0x13c3 [rtw89_core] ? __pfx_rtw89_fw_h2c_scan_offload_be+0x10/0x10 [rtw89_core] ? do_raw_spin_lock+0x75/0xdb ? __pfx_do_raw_spin_lock+0x10/0x10 rtw89_hw_scan_offload+0xb5e/0xbf7 [rtw89_core] ? _raw_spin_unlock+0xe/0x24 ? __mutex_lock.constprop.0+0x40c/0x471 ? __pfx_rtw89_hw_scan_offload+0x10/0x10 [rtw89_core] ? __mutex_lock_slowpath+0x13/0x1f ? mutex_lock+0xa2/0xdc ? __pfx_mutex_lock+0x10/0x10 rtw89_hw_scan_abort+0x58/0xb7 [rtw89_core] rtw89_ops_cancel_hw_scan+0x120/0x13b [rtw89_core] ieee80211_scan_cancel+0x468/0x4d0 [mac80211] ieee80211_prep_connection+0x858/0x899 [mac80211] ieee80211_mgd_auth+0xbea/0xdde [mac80211] ? __pfx_ieee80211_mgd_auth+0x10/0x10 [mac80211] ? cfg80211_find_elem+0x15/0x29 [cfg80211] ? is_bss+0x1b7/0x1d7 [cfg80211] ieee80211_auth+0x18/0x27 [mac80211] cfg80211_mlme_auth+0x3bb/0x3e7 [cfg80211] cfg80211_conn_do_work+0x410/0xb81 [cfg80211] ? __pfx_cfg80211_conn_do_work+0x10/0x10 [cfg80211] ? __kasan_check_read+0x11/0x1f ? psi_group_change+0x8bc/0x944 ? __kasan_check_write+0x14/0x22 ? mutex_lock+0x8e/0xdc ? __pfx_mutex_lock+0x10/0x10 ? __pfx___radix_tree_lookup+0x10/0x10 cfg80211_conn_work+0x245/0x34d [cfg80211] ? __pfx_cfg80211_conn_work+0x10/0x10 [cfg80211] ? update_cfs_rq_load_avg+0x3bc/0x3d7 ? sched_clock_noinstr+0x9/0x1a ? sched_clock+0x10/0x24 ? sched_clock_cpu+0x7e/0x42e ? newidle_balance+0x796/0x937 ? __pfx_sched_clock_cpu+0x10/0x10 ? __pfx_newidle_balance+0x10/0x10 ? __kasan_check_read+0x11/0x1f ? psi_group_change+0x8bc/0x944 ? _raw_spin_unlock+0xe/0x24 ? raw_spin_rq_unlock+0x47/0x54 ? raw_spin_rq_unlock_irq+0x9/0x1f ? finish_task_switch.isra.0+0x347/0x586 ? __schedule+0x27bf/0x2892 ? mutex_unlock+0x80/0xd0 ? do_raw_spin_lock+0x75/0xdb ? __pfx___schedule+0x10/0x10 process_scheduled_works+0x58c/0x821 worker_thread+0x4c7/0x586 ? __kasan_check_read+0x11/0x1f kthread+0x285/0x294 ? __pfx_worker_thread+0x10/0x10 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x29/0x6f ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1b/0x30 </TASK>
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade kernel-devel-matchedUpgrade kernel-rt-64k-modulesUpgrade kernel-cross-headersUpgrade kernel-docUpgrade kernel-modules-coreUpgrade kernel-rt-debug-modules-extraUpgrade kernel-rt-modules-coreUpgrade kernel-uki-virt-addonsUpgrade kernelUpgrade kernel-rt-64k-debug-modulesUpgrade kernel-abi-stablelistsUpgrade kernel-rt-64k-modules-coreUpgrade kernel-64k-coreUpgrade kernel-64k-modulesUpgrade kernel-64k-devel-matchedUpgrade rvUpgrade kernel-uki-virtUpgrade kernel-rt-64k-debug-coreUpgrade kernel-rt-64k-modules-extraUpgrade kernel-64k-debugUpgrade kernel-rtUpgrade kernel-zfcpdump-modules-coreUpgrade kernel-rt-64kUpgrade kernel-rt-debug-develUpgrade kernel-64k-debug-devel-matchedUpgrade libperfUpgrade kernel-zfcpdump-modulesUpgrade kernel-zfcpdump-coreUpgrade kernel-debug-devel-matchedUpgrade kernel-zfcpdump-develUpgrade kernel-toolsUpgrade kernel-rt-64k-debugUpgrade kernel-debug-modules-extraUpgrade kernel-tools-libs-develUpgrade kernel-64k-debug-modules-extraUpgrade kernel-headersUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-modulesUpgrade kernel-debug-develUpgrade kernel-rt-debugUpgrade kernel-rt-64k-coreUpgrade kernel-zfcpdump-devel-matchedUpgrade kernel-rt-64k-develUpgrade kernel-rt-64k-debug-develUpgrade kernel-tools-libsUpgrade kernel-coreUpgrade kernel-debugUpgrade kernel-rt-64k-debug-modules-coreUpgrade kernel-rt-coreUpgrade kernel-debug-modulesUpgrade kernel-64k-modules-coreUpgrade kernel-rt-debug-coreUpgrade kernel-zfcpdumpUpgrade kernel-64k-develUpgrade kernel-rt-64k-debug-modules-extraUpgrade kernel-debug-uki-virtUpgrade rtlaUpgrade kernel-debug-coreUpgrade kernel-rt-modulesUpgrade kernel-modules-extraUpgrade kernel-rt-develUpgrade kernel-64k-debug-develUpgrade kernel-64k-debug-modulesUpgrade kernel-64kUpgrade kernel-rt-debug-modules-coreUpgrade kernel-64k-debug-modules-coreUpgrade perfUpgrade kernel-rt-modules-extraUpgrade kernel-debug-modules-coreUpgrade kernel-64k-modules-extraUpgrade kernel-develUpgrade kernel-64k-debug-coreUpgrade python3-perfUpgrade kernel-rt-debug-modules | Nov 20, 2025 | Nov 11, 2025 |
| Debian | — | No solution existsUpgrade linux | May 15, 2025 | Feb 27, 2025 |
| Oracle_linux | — | Upgrade kernel | Nov 28, 2025 | Feb 27, 2025 |
| Redhat_linux | — | Upgrade kernelUpgrade kernel-rtNo solution exists | Jul 9, 2025 | Feb 27, 2025 |
| Rocky_linux | — | Upgrade kernel-debuginfo-common-x86_64Upgrade kernel-tools-debuginfoUpgrade kernel-debug-modulesUpgrade rtlaUpgrade kernel-debug-debuginfoUpgrade kernel-rt-debug-modules-coreUpgrade kernel-devel-matchedUpgrade libperfUpgrade kernel-rt-debugUpgrade kernel-coreUpgrade kernel-rt-debug-modules-extraUpgrade kernel-rt-coreUpgrade kernel-rt-debug-modulesUpgrade kernel-debugUpgrade kernel-modules-extraUpgrade kernel-modules-coreUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-modulesUpgrade perf-debuginfoUpgrade kernel-debug-modules-coreUpgrade kernel-debug-coreUpgrade kernel-debug-uki-virtUpgrade perfUpgrade kernel-zfcpdumpUpgrade kernel-debuginfoUpgrade kernel-develUpgrade kernel-rt-debug-develUpgrade kernel-debug-develUpgrade kernel-zfcpdump-develUpgrade kernel-tools-libsUpgrade kernel-uki-virtUpgrade python3-perfUpgrade kernel-debug-modules-extraUpgrade kernel-rtUpgrade libperf-debuginfoUpgrade kernel-rt-debug-debuginfoUpgrade kernel-rt-debug-coreUpgrade kernel-zfcpdump-modulesUpgrade kernel-rt-modules-extraUpgrade kernel-zfcpdump-devel-matchedUpgrade kernel-zfcpdump-coreUpgrade kernel-rt-debuginfoUpgrade python3-perf-debuginfoUpgrade kernel-rt-modulesUpgrade kernel-debuginfo-common-s390xUpgrade kernel-zfcpdump-modules-coreUpgrade kernel-rt-modules-coreUpgrade kernel-rt-develUpgrade kernel-uki-virt-addonsUpgrade kernel-tools-libs-develUpgrade kernelUpgrade kernel-debug-devel-matchedUpgrade rvUpgrade kernel-zfcpdump-debuginfoUpgrade kernel-tools | Feb 5, 2026 | Nov 21, 2025 |
| Suse | — | Upgrade ocfs2-kmp-defaultUpgrade kernel-syms-azureUpgrade dtb-apmUpgrade ocfs2-kmp-azureUpgrade reiserfs-kmp-azureUpgrade gfs2-kmp-azureUpgrade dlm-kmp-azureUpgrade kernel-devel-azureUpgrade dtb-xilinxUpgrade gfs2-kmp-64kbUpgrade dtb-allwinnerUpgrade kernel-default-vdsoUpgrade kernel-develUpgrade kernel-default-extraUpgrade kernel-default-base-rebuildUpgrade kernel-64kb-develUpgrade dtb-armUpgrade dtb-exynosUpgrade dtb-qcomUpgrade dtb-nvidiaUpgrade gfs2-kmp-rtUpgrade kernel-sourceUpgrade dlm-kmp-rtUpgrade kernel-devel-rtUpgrade kernel-defaultUpgrade kernel-default-optionalUpgrade dtb-hisiliconUpgrade cluster-md-kmp-rtUpgrade kselftests-kmp-defaultUpgrade kernel-symsUpgrade kernel-obs-qaUpgrade kernel-zfcpdumpUpgrade kernel-rt-develUpgrade kselftests-kmp-64kbUpgrade kernel-rtUpgrade dtb-mediatekUpgrade kernel-docsUpgrade dtb-rockchipUpgrade kernel-debugUpgrade reiserfs-kmp-defaultUpgrade dtb-caviumUpgrade ocfs2-kmp-rtUpgrade kernel-default-livepatch-develUpgrade gfs2-kmp-defaultUpgrade kernel-rt-optionalUpgrade kernel-rt_debugUpgrade kernel-azure-extraUpgrade kernel-obs-buildUpgrade dtb-alteraUpgrade dlm-kmp-64kbUpgrade cluster-md-kmp-defaultUpgrade kernel-source-rtUpgrade cluster-md-kmp-azureUpgrade kselftests-kmp-azureUpgrade kernel-rt_debug-vdsoUpgrade kernel-macrosUpgrade kselftests-kmp-rtUpgrade kernel-syms-rtUpgrade dtb-sprdUpgrade dtb-socionextUpgrade kernel-kvmsmall-vdsoUpgrade kernel-kvmsmall-develUpgrade kernel-default-livepatchUpgrade dtb-broadcomUpgrade dtb-amlogicUpgrade dtb-amazonUpgrade kernel-default-develUpgrade dtb-appleUpgrade cluster-md-kmp-64kbUpgrade kernel-source-azureUpgrade kernel-default-baseUpgrade kernel-azure-vdsoUpgrade kernel-rt-livepatch-develUpgrade dtb-amdUpgrade dlm-kmp-defaultUpgrade kernel-64kb-extraUpgrade kernel-debug-vdsoUpgrade kernel-64kb-optionalUpgrade dtb-renesasUpgrade dtb-freescaleUpgrade reiserfs-kmp-rtUpgrade kernel-docs-htmlUpgrade dtb-lgUpgrade dtb-marvellUpgrade ocfs2-kmp-64kbUpgrade reiserfs-kmp-64kbUpgrade kernel-rt-vdsoUpgrade kernel-azure-develUpgrade kernel-64kbUpgrade kernel-debug-develUpgrade kernel-azureUpgrade kernel-azure-optionalUpgrade kernel-source-vanillaUpgrade kernel-kvmsmallUpgrade kernel-rt-extraUpgrade kernel-rt_debug-devel | May 26, 2025 | Feb 27, 2025 |
| Ubuntu | — | Upgrade linux-image-6.8.0-1020-xilinxUpgrade linux-image-xilinx-zynqmpUpgrade linux-image-nvidia-lowlatencyUpgrade linux-image-aws-fipsUpgrade linux-image-gcp-fipsUpgrade linux-image-gcp-64k-6.8Upgrade linux-image-oracle-6.8Upgrade linux-image-nvidia-6.8Upgrade linux-image-azure-fipsUpgrade linux-image-virtual-6.8Upgrade linux-image-6.8.0-1044-gcpUpgrade linux-image-gke-6.8Upgrade linux-image-6.8.0-1043-nvidia-lowlatency-64kUpgrade linux-image-azure-nvidia-6.8Upgrade linux-image-oem-22.04dUpgrade linux-image-aws-fips-6.8Upgrade linux-image-6.8.0-1043-awsUpgrade linux-image-realtime-6.8.1Upgrade linux-image-aws-lts-24.04Upgrade linux-image-oracle-64k-lts-24.04Upgrade linux-image-gcp-lts-24.04Upgrade linux-image-azure-nvidia-lts-24.04Upgrade linux-image-6.8.0-1040-oracleUpgrade linux-image-6.8.0-1027-gkeopUpgrade linux-image-oracle-64k-6.8Upgrade linux-image-6.8.1-1038-realtimeUpgrade linux-image-xilinx-6.8Upgrade linux-image-raspi-6.8Upgrade linux-image-6.8.0-1044-azure-fipsUpgrade linux-image-gcp-64kUpgrade linux-image-aws-64k-lts-24.04Upgrade linux-image-gke-64k-6.8Upgrade linux-image-generic-64k-6.8Upgrade linux-image-oem-22.04cUpgrade linux-image-6.8.0-1043-aws-64kUpgrade linux-image-raspi-realtime-6.8Upgrade linux-image-genericUpgrade linux-image-6.8.0-2034-raspi-realtimeUpgrade linux-image-6.8.0-1043-nvidia-lowlatencyUpgrade linux-image-gke-64kUpgrade linux-image-gkeopUpgrade linux-image-virtual-hwe-22.04Upgrade linux-image-raspiUpgrade linux-image-lowlatency-6.8Upgrade linux-image-generic-64kUpgrade linux-image-6.8.0-1040-gkeUpgrade linux-image-6.8.0-1044-azureUpgrade linux-image-nvidiaUpgrade linux-image-azureUpgrade linux-image-aws-6.8Upgrade linux-image-gcp-fips-6.8Upgrade linux-image-oem-22.04bUpgrade linux-image-6.8.0-88-lowlatency-64kUpgrade linux-image-6.8.0-1044-gcp-64kUpgrade linux-image-6.8.0-1043-raspiUpgrade linux-image-6.8.0-88-genericUpgrade linux-image-nvidia-lowlatency-64k-6.8Upgrade linux-image-6.8.0-88-lowlatencyUpgrade linux-image-6.8.0-88-fipsUpgrade linux-image-fipsUpgrade linux-image-lowlatencyUpgrade linux-image-nvidia-64k-6.8Upgrade linux-image-azure-fips-6.8Upgrade linux-image-6.8.0-1043-aws-fipsUpgrade linux-image-ibm-classicUpgrade linux-image-6.8.0-1044-gcp-fipsUpgrade linux-image-lowlatency-64k-hwe-22.04Upgrade linux-image-generic-6.8Upgrade linux-image-ibm-6.8Upgrade linux-image-nvidia-lowlatency-6.8Upgrade linux-image-generic-64k-hwe-22.04Upgrade linux-image-awsUpgrade linux-image-6.8.0-1043-nvidia-64kUpgrade linux-image-aws-64k-6.8Upgrade linux-image-6.8.0-1040-oracle-64kUpgrade linux-image-gcp-64k-lts-24.04Upgrade linux-image-realtimeUpgrade linux-image-nvidia-64k-hwe-22.04Upgrade linux-image-generic-lpaeUpgrade linux-image-oem-22.04aUpgrade linux-image-nvidia-lowlatency-64kUpgrade linux-image-azure-lts-24.04Upgrade linux-image-lowlatency-64kUpgrade linux-image-generic-hwe-22.04Upgrade linux-image-ibm-lts-24.04Upgrade linux-image-oracle-lts-24.04Upgrade linux-image-virtualUpgrade linux-image-oracleUpgrade linux-image-oem-22.04Upgrade linux-image-gkeop-6.8Upgrade linux-image-nvidia-hwe-22.04Upgrade linux-image-ibmUpgrade linux-image-aws-64kUpgrade linux-image-gcp-6.8Upgrade linux-image-gcpUpgrade linux-image-lowlatency-64k-6.8Upgrade linux-image-6.8.0-1029-azure-nvidiaUpgrade linux-image-6.8.0-1040-gke-64kUpgrade linux-image-raspi-realtimeUpgrade linux-image-xilinxUpgrade linux-image-lowlatency-hwe-22.04Upgrade linux-image-azure-6.8Upgrade linux-image-gkeUpgrade linux-image-nvidia-64kUpgrade linux-image-6.8.0-1043-nvidiaUpgrade linux-image-6.8.0-1041-ibmUpgrade linux-image-fips-6.8Upgrade linux-image-kvmUpgrade linux-image-oracle-64kUpgrade linux-image-6.8.0-88-generic-64k | Jun 26, 2025 | Feb 27, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub