CVE-2026-23073: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-23073 Overview

A memory corruption vulnerability has been identified in the Linux kernel's RSI911x WiFi driver (wifi: rsi). The vulnerability occurs because the driver fails to properly set the virtual interface (vif) driver data size when allocating the ieee80211_vif structure. This results in out-of-bounds memory access when the driver attempts to use the vif driver private data area, leading to memory corruption that can cause system crashes.

Critical Impact

This vulnerability allows local users to trigger kernel memory corruption, potentially causing denial of service through system crashes. The vulnerability is easily triggered by simple network interface operations.

Affected Products

• Linux Kernel with RSI911x WiFi driver enabled
• Systems using RedPine Signals RSI911x WiFi chipsets
• Linux distributions with CONFIG_RSI_91X kernel configuration enabled

Discovery Timeline

• 2026-02-04 - CVE CVE-2026-23073 published to NVD
• 2026-02-05 - Last updated in NVD database

Technical Details for CVE-2026-23073

Vulnerability Analysis

The vulnerability resides in the RSI911x WiFi driver's handling of the ieee80211_vif structure allocation. In the Linux WiFi subsystem, the struct ieee80211_vif contains trailing space for driver-specific private data. When this structure is allocated, the total memory size should be sizeof(struct ieee80211_vif) plus the size of the driver's private data structure, which each WiFi driver must specify according to its needs.

The RSI911x driver neglects to set this vif driver data size, meaning no trailing space is allocated beyond the base ieee80211_vif structure. However, the driver still attempts to use vif->drv_priv to store its private data structure struct vif_priv. This results in out-of-bounds writes that corrupt adjacent memory.

Root Cause

The root cause is a missing initialization of the vif driver data size in the RSI911x driver. When the driver calls into the mac80211 subsystem, the ieee80211_vif structure is allocated without accounting for the space needed by struct vif_priv. The driver then writes to vif->drv_priv as if that memory had been properly allocated, corrupting whatever memory happens to follow the ieee80211_vif structure.

In observed crashes, the memory corruption specifically affects struct fq_tin member struct list_head new_flows. When fq_tin_reset() subsequently iterates over this corrupted list, it encounters a bogus non-NULL address, and accessing this corrupted pointer causes a kernel crash.

Attack Vector

The vulnerability can be triggered through basic network interface management operations. The attack sequence is straightforward:

1. Bring up the WiFi interface (ip link set wlan0 up)
2. Wait briefly for initialization
3. Bring down the WiFi interface (ip link set wlan0 down)

This triggers the memory corruption in rsi_mac80211_add_interface() when the driver writes vif_info->vap_id = vap_idx to the unallocated memory region. The crash occurs during interface teardown when the corrupted fq_tin list is processed.

The vulnerability requires local access to the system and the ability to manage network interfaces, which typically requires root privileges or CAP_NET_ADMIN capability.

Detection Methods for CVE-2026-23073

Indicators of Compromise

• Kernel panic or oops messages referencing fq_tin_reset() or rsi_mac80211_add_interface()
• System crashes during WiFi interface up/down operations on systems with RSI911x chipsets
• Memory corruption indicators in kernel logs related to list corruption in the WiFi subsystem
• Unexpected system instability when managing wlan0 interfaces using RSI911x driver

Detection Strategies

• Monitor kernel logs for oops or panic traces involving rsi_91x module functions
• Implement runtime kernel memory debugging features such as KASAN (Kernel Address Sanitizer) to detect out-of-bounds accesses
• Track kernel module loading for rsi_91x and correlate with system stability issues
• Use system auditing to log network interface state changes on affected systems

Monitoring Recommendations

• Enable kernel crash dump collection (kdump) to capture diagnostic information if the vulnerability is triggered
• Monitor for unexpected system reboots or kernel panic events on systems with RSI911x WiFi hardware
• Set up alerting on kernel log patterns matching RSI driver errors or list corruption messages
• Regularly audit system logs for signs of memory corruption in network subsystems

How to Mitigate CVE-2026-23073

Immediate Actions Required

• Update the Linux kernel to a patched version that includes the fix for CVE-2026-23073
• If immediate patching is not possible, consider blacklisting or unloading the rsi_91x kernel module
• Restrict CAP_NET_ADMIN capability to trusted users only to limit who can trigger the vulnerability
• Monitor affected systems closely for signs of exploitation or crashes

Patch Information

The fix involves setting the correct size of vif driver data to match sizeof(struct vif_priv). This ensures that when ieee80211_vif is allocated, sufficient trailing space is reserved for the driver's private data structure, preventing the out-of-bounds writes.

Multiple kernel commits address this vulnerability across different stable kernel branches:

• Kernel Commit 31efbcff9088
• Kernel Commit 4f431d88ea80
• Kernel Commit 7761d7801f40
• Kernel Commit 99129d80a5d4

Workarounds

• Blacklist the rsi_91x module by adding blacklist rsi_91x to /etc/modprobe.d/blacklist.conf if the WiFi hardware is not needed
• Use an alternative WiFi adapter with a different driver if RSI911x functionality is not essential
• Restrict physical access and administrative privileges on affected systems until patches can be applied
• Consider using a USB WiFi adapter with a different chipset as a temporary replacement

# Blacklist the vulnerable RSI911x driver module
echo "blacklist rsi_91x" | sudo tee /etc/modprobe.d/blacklist-rsi.conf
echo "blacklist rsi_sdio" | sudo tee -a /etc/modprobe.d/blacklist-rsi.conf
echo "blacklist rsi_usb" | sudo tee -a /etc/modprobe.d/blacklist-rsi.conf

# Unload the module if currently loaded
sudo modprobe -r rsi_91x 2>/dev/null || true
sudo modprobe -r rsi_sdio 2>/dev/null || true
sudo modprobe -r rsi_usb 2>/dev/null || true

# Update initramfs to persist the blacklist
sudo update-initramfs -u