CVE-2026-53112: Linux rtlwifi Use-After-Free Privilege Escalation

Technical summary

The rtlwifi PCI driver initializes a tasklet named irq_prepare_bcn_tasklet in rtl_pci_init() to handle beacon-related interrupts. However, the corresponding rtl_pci_deinit() cleanup function never calls tasklet_kill() to stop this tasklet. If the IEEE 802.11 hardware abstraction (ieee80211_hw) is deallocated while the tasklet is still scheduled or running—such as during driver probe failure or device detachment—the tasklet's callback (_rtl_pci_prepare_bcn_tasklet) will access freed memory, triggering a use-after-free condition. This flaw was discovered through static analysis rather than in-the-wild exploitation.

Business impact

While this vulnerability requires local access and user-level privileges to trigger, successful exploitation could crash WiFi functionality system-wide, cause kernel panics, or enable privilege escalation from a standard user account to kernel level. Organizations running laptops or edge devices with rtlwifi chips face service disruption; more critically, a compromised user account could gain kernel access. The impact is highest in multi-user or high-security environments where user isolation is important.

Affected systems

Linux systems with rtlwifi PCI-based WiFi adapters are affected. This includes many consumer laptops, embedded systems, and development boards using Realtek wireless chipsets that rely on the mainline kernel's rtlwifi driver. The vulnerability is present in the kernel until the fix is applied; the exact affected kernel versions depend on when this code was introduced, which should be verified in your distribution's advisory.

Exploitability

The vulnerability requires local code execution with user-level privileges (no root needed) and is triggered by specific hardware events (WiFi card insertion/removal or initialization failure). An attacker cannot exploit this remotely; they must have local system access. The attack surface is limited to scenarios where an unprivileged user can cause or trigger device attach/detach cycles. Complexity is low once local access is obtained, but privilege or physical access may be a practical barrier in many environments.

Remediation

Apply a kernel update that includes the fix for CVE-2026-53112. The patch adds a tasklet_kill(irq_prepare_bcn_tasklet) call in the rtl_pci_deinit() function to ensure the tasklet is terminated before the ieee80211_hw structure is freed. Verify the specific patched kernel version for your Linux distribution through your vendor's security advisory. For systems where immediate patching is not feasible, disabling the rtlwifi driver (if alternative WiFi hardware or methods are available) will eliminate the attack surface.

Patch guidance

Monitor your Linux distribution's kernel security advisories for the patched version addressing CVE-2026-53112. Major distributions (Ubuntu, Red Hat, Debian, SUSE, etc.) will release updated kernel packages; apply them through standard patch management processes once available. If you manage custom kernels, cherry-pick the fix from the upstream Linux kernel repository and recompile. Test patched kernels in a non-production environment first, particularly WiFi functionality, to ensure stability.

Detection guidance

Monitor kernel logs (dmesg, journalctl) for use-after-free warnings, page faults, or BUG messages referencing _rtl_pci_prepare_bcn_tasklet or rtlwifi. Systems with Address Sanitizer or kernel debugging enabled will show more detailed crashes. Inspect running kernel version using `uname -r` and cross-reference against distribution security bulletins. If rtlwifi is not in use, verify it is not loaded (lsmod | grep rtl). Endpoint Detection and Response (EDR) tools may flag kernel panic or crash events, but detection relies primarily on kernel logs and patch status tracking.

Why prioritize this

This vulnerability merits high priority remediation due to its CVSS 7.8 (HIGH) score, local privilege escalation potential, and the ubiquity of rtlwifi drivers in consumer and enterprise Linux systems. Although it requires local access, the combination of user-level triggering and kernel-level impact makes it a significant risk for multi-user systems, development workstations, and any environment where untrusted users have local access. It is not currently tracked as actively exploited in the wild (KEV status is false), but the straightforward nature of the fix suggests it should be treated as stable and deployable without excessive testing delays.

Risk score, explained

CVSS 7.8 reflects HIGH severity: Attack Vector Local (AV:L) means local access is required; Attack Complexity Low (AC:L) indicates no special conditions or timing; Privileges Required Low (PR:L) means an unprivileged user can trigger it; User Interaction None (UI:N) means no interaction needed; and Scope Unchanged (S:U) keeps impact within the vulnerable component. The high impact scores (Confidentiality, Integrity, Availability all High) reflect the use-after-free's potential for memory corruption leading to kernel crashes or privilege escalation. The score is appropriate for a memory safety flaw affecting privileged kernel code.

Frequently asked questions