CVE-2026-53112

wifi: rtlwifi: pci: fix possible use-after-free caused by unfinished irq_prepare_bcn_tasklet

published June 24, 2026

CVSS
—
EPSS
0%
Percentile
6.2
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

wifi: rtlwifi: pci: fix possible use-after-free caused by unfinished irq_prepare_bcn_tasklet

The irq_prepare_bcn_tasklet is initialized in rtl_pci_init() and

scheduled when RTL_IMR_BCNINT interrupt is triggered by hardware.

But it is never killed in rtl_pci_deinit(). When the rtlwifi card

probe fails or is being detached, the ieee80211_hw is deallocated.

However, irq_prepare_bcn_tasklet may still be running or pending,

leading to use-after-free when the freed ieee80211_hw is accessed

in _rtl_pci_prepare_bcn_tasklet().

Similar to irq_tasklet, add tasklet_kill() in rtl_pci_deinit() to

ensure that irq_prepare_bcn_tasklet is properly terminated before

the ieee80211_hw is released.

The issue was identified through static analysis.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00171 · 6.2th percentile
Published
2026-06-24T16:30Z
EPSS history
Timeline
  • 24 JUN 16:30Z
    wifi: rtlwifi: pci: fix possible use-after-free caused by unfinished irq_prepare_bcn_tasklet
    cvelistv5