CVE-2026-46187: Linux RSI Driver Use-After-Free Vulnerability (CVSS 4.7)

Technical summary

CVE-2026-46187 is a use-after-free (UAF) vulnerability in the Linux kernel's RSI (Redpine Signals) Wi-Fi driver thread lifecycle management. The vulnerability arises from a race condition between kthread_complete_and_exit() and kthread_stop(). The driver's kthread management has a design flaw: both self-exit and external-stop mechanisms coexist. When kthread_complete_and_exit() executes first and frees the kthread object, a subsequent call to kthread_stop() attempts to dereference freed memory. The fix involves removing the kthread_stop() call and replacing it with a synchronization mechanism that waits for the self-exit operation to complete. The vulnerability is classified as CWE-362 (concurrent execution using shared resource with improper synchronization).

Business impact

This vulnerability primarily affects availability rather than confidentiality or integrity. Systems running affected Linux kernel versions with the RSI wireless driver loaded are susceptible to kernel panics or system hangs triggered by a local attacker with limited user privileges. For organizations relying on wireless connectivity via RSI hardware, exploitation could disrupt service availability. The low CVSS score (4.7) reflects the local attack vector and high complexity required to trigger the race condition, but in high-density wireless environments or embedded systems where RSI drivers are deployed, availability impact could be operationally significant.

Affected systems

The Linux kernel's RSI wireless driver is affected. This driver is used in systems with Redpine Signals Wi-Fi hardware. The vulnerability requires local access and user-level privileges, limiting exposure to multi-user systems, shared hosting environments, or scenarios where local attackers can execute code. Embedded systems, IoT devices, or laptops with RSI-based Wi-Fi adapters running vulnerable kernel versions are in scope. The impact is narrower than many kernel vulnerabilities because RSI is a specific driver for particular hardware; however, some commodity wireless cards and certain development boards use RSI chipsets.

Exploitability

Exploitation requires local system access with non-root user privileges, reducing the threat surface significantly. An attacker must trigger the precise race condition window between the self-exit and external-stop calls—a timing-dependent issue that may require repeated attempts or careful crafting of kernel thread lifecycle events. The high complexity factor (AC:H in the CVSS vector) reflects this difficulty. This is not a trivial remote or unauthenticated attack. No known public exploits are tracked in the KEV catalog, and the specific timing requirements make reliable, weaponized exploitation challenging for the general attacker population.

Remediation

Apply a Linux kernel patch that removes the kthread_stop() call from the RSI driver's shutdown path and implements proper synchronization to await the kthread self-exit operation. Verification against your Linux distribution's security advisory or the kernel.org advisory is required to confirm which kernel versions ship the fix. Most major distributions have backported patches available for stable kernel branches. For systems where immediate patching is impractical, restrict local shell access and monitor for unexpected crashes or wireless driver errors as interim mitigations.

Patch guidance

Consult your Linux distribution's security advisory for the patched kernel version applicable to your release. Canonical (Ubuntu), Red Hat, Debian, and others typically release kernel updates addressing this issue within their respective maintenance windows. Verify the patch against the kernel.org advisory (linux-kernel mailing list) to confirm the exact commit hash and version numbers. Test kernel updates in a non-production environment first, as kernel updates require a reboot. For long-term support (LTS) kernels, patches are generally available; for cutting-edge releases, updates should arrive rapidly.

Detection guidance

Monitor kernel logs (dmesg, journalctl) for UAF-related warnings, use-after-free splats, or RSI driver crash indicators. Kernel Address Sanitizer (KASAN) configurations, if enabled in your kernel build, will flag UAF attempts with detailed stack traces. System administrators should look for patterns of Wi-Fi driver crashes or unexpected kernel panics on systems with RSI wireless hardware. Correlate crashes with local user activity or privilege escalation attempts. Intrusion detection systems focused on kernel behavior may detect anomalous thread lifecycle events, though this requires custom signatures tuned to your environment.

Why prioritize this

Although the CVSS score is moderate (4.7), prioritization should account for the attack vector (local only), the complexity of triggering the race condition, and the specific hardware dependency. If your organization does not use RSI wireless drivers, the risk is negligible. However, for systems that do rely on RSI hardware—particularly in edge computing, IoT, or specific embedded deployments—the availability impact justifies prompt remediation. The lack of KEV tracking and public exploits suggests this is a quality fix rather than an emergency response. Standard patch cadence is appropriate unless RSI wireless is critical to your infrastructure.

Risk score, explained

The CVSS 3.1 score of 4.7 (MEDIUM) reflects: (1) local-only attack vector (AV:L), requiring an attacker already on the system; (2) high attack complexity (AC:H), as the race condition is difficult and unreliable to trigger; (3) low privileges (PR:L), allowing non-root users to attempt exploitation; (4) no user interaction required (UI:N); (5) no impact to confidentiality or integrity (C:N/I:N), but high availability impact (A:H) from potential kernel crashes. The moderate score appropriately balances the serious availability risk against the practical barriers to exploitation.

Frequently asked questions