CVE-2026-46187: Linux Kernel RSI Use-After-Free Flaw

CVE-2026-46187 Overview

CVE-2026-46187 is a use-after-free vulnerability in the Linux kernel's RSI Wi-Fi driver caused by a race condition between two kthread termination paths. The RSI driver uses both self-exit (kthread_complete_and_exit) and external-stop (kthread_stop) when killing a kthread. When kthread_complete_and_exit() executes before kthread_stop(), the kthread object is freed but accessed again, producing a use-after-free condition. The upstream fix removes kthread_stop() and waits for the self-exit operation to complete.

Critical Impact
Local triggering of the race can corrupt kernel memory through use-after-free on a freed kthread structure, potentially enabling denial of service or kernel memory corruption on systems using Redpine Signals (RSI) Wi-Fi hardware.

Affected Products

Linux kernel wifi: rsi driver (Redpine Signals Wi-Fi)
Multiple stable Linux kernel branches (five backport commits published)
Systems with RSI 91x-series Wi-Fi adapters

Discovery Timeline

2026-05-28 - CVE-2026-46187 published to NVD
2026-05-28 - Last updated in NVD database

Technical Details for CVE-2026-46187

Vulnerability Analysis

The RSI driver terminates a worker kthread through two competing mechanisms. The first path is self-exit, where the kthread invokes kthread_complete_and_exit() and the kernel frees the underlying task_struct once references drop. The second path is external-stop, where another thread calls kthread_stop() on the same kthread, dereferencing its task structure to set the stop flag and wait for exit.

In the common ordering, kthread_stop() runs first and synchronizes with the kthread cleanly. In the racy ordering, the kthread calls kthread_complete_and_exit() first. The kthread object exits and is released. A subsequent call to kthread_stop() then dereferences the freed kthread, producing the use-after-free [CWE-416].

This is a kernel-level race condition affecting an in-tree Wi-Fi driver. Exploitation requires the ability to trigger the driver teardown path, typically through interface management or device removal.

Root Cause

The root cause is a lifetime management contract violation. kthread_stop() requires that the target kthread remain valid until the stop call returns. By also allowing the kthread to self-exit via kthread_complete_and_exit(), the RSI driver permits the kthread to be freed before kthread_stop() accesses it. The two termination strategies were not mutually exclusive in the driver's shutdown logic.

Attack Vector

The race is reachable through normal driver lifecycle events that trigger kthread teardown, such as interface down, module unload, or device disconnect. Triggering the specific ordering is timing-dependent and described as rare in the upstream commit message. A local attacker with privileges to manipulate the wireless interface or trigger device removal could attempt to provoke the race.

No verified proof-of-concept code is published for this CVE. The fix consists of removing the kthread_stop() call and waiting for the self-exit completion. Refer to the Linux Kernel Commit for the upstream patch details.

Detection Methods for CVE-2026-46187

Indicators of Compromise

Kernel oops or panic traces referencing kthread_stop and the RSI driver call stack
KASAN use-after-free reports naming task_struct allocations originating from RSI worker thread creation
Unexpected RSI Wi-Fi driver crashes during interface teardown, module unload, or device hot-removal

Detection Strategies

Enable KASAN on test kernels to catch the use-after-free during RSI driver teardown
Audit running kernel versions against the five stable backport commits referenced in NVD
Inventory hosts using RSI 91x-series Wi-Fi adapters, which are the only systems exposed to this code path

Monitoring Recommendations

Forward dmesg and /var/log/kern.log to a central log store and alert on RSI driver oops messages
Track kernel package versions across the Linux fleet to confirm the patch is deployed on all affected branches
Monitor for unexplained reboots or kernel crashes on systems with RSI Wi-Fi hardware

How to Mitigate CVE-2026-46187

Immediate Actions Required

Apply the upstream kernel patches referenced by the five git.kernel.org/stable commits for your kernel branch
Update to a distribution kernel that includes the RSI kthread lifetime fix
Where patching is not immediate, unload the rsi_91x and related RSI modules on systems that do not require RSI Wi-Fi

Patch Information

The fix is upstream in the Linux kernel and backported to multiple stable branches. The relevant commits are: Linux Kernel Commit #1, Linux Kernel Commit #2, Linux Kernel Commit #3, Linux Kernel Commit #4, and Linux Kernel Commit #5. The patch removes the kthread_stop() call and waits for the kthread self-exit to complete.

Workarounds

Blocklist the RSI driver modules on hosts that do not use RSI Wi-Fi hardware
Restrict local access and wireless interface management privileges to reduce opportunities to trigger driver teardown
Avoid repeated bring-up and tear-down cycles of RSI interfaces until the patched kernel is deployed

bash

# Blocklist the RSI driver on systems that do not require it
echo 'blacklist rsi_usb' | sudo tee /etc/modprobe.d/blacklist-rsi.conf
echo 'blacklist rsi_sdio' | sudo tee -a /etc/modprobe.d/blacklist-rsi.conf
echo 'blacklist rsi_91x' | sudo tee -a /etc/modprobe.d/blacklist-rsi.conf
sudo update-initramfs -u

# Verify installed kernel version against patched stable releases
uname -r