CVE-2026-53112: Linux Kernel Use-After-Free Vulnerability

CVE-2026-53112 Overview

CVE-2026-53112 is a use-after-free vulnerability in the Linux kernel's rtlwifi PCI wireless driver. The flaw resides in the beacon interrupt handling path, where irq_prepare_bcn_tasklet is initialized in rtl_pci_init() and scheduled when the RTL_IMR_BCNINT hardware interrupt fires. The tasklet is never terminated in rtl_pci_deinit(). When a rtlwifi card probe fails or the device is detached, the ieee80211_hw structure is deallocated while the tasklet may still be running or pending. The pending tasklet then accesses the freed ieee80211_hw in _rtl_pci_prepare_bcn_tasklet(). The issue was identified through static analysis and applies to systems running affected Linux kernel versions with Realtek PCI wireless hardware.

Critical Impact
Local kernel-level use-after-free that can lead to memory corruption, kernel crash, or potential privilege escalation on systems with Realtek PCI Wi-Fi adapters during driver probe failure or device detach.

Affected Products

Linux kernel rtlwifi PCI driver (drivers/net/wireless/realtek/rtlwifi/pci.c)
Multiple stable Linux kernel branches per the upstream fix commits
Systems using Realtek PCI/PCIe wireless network adapters supported by rtlwifi

Discovery Timeline

2026-06-24 - CVE-2026-53112 published to NVD
2026-06-24 - Last updated in NVD database

Technical Details for CVE-2026-53112

Vulnerability Analysis

The vulnerability is a use-after-free [CWE-416] in the rtlwifi PCI driver's beacon tasklet lifecycle. The irq_prepare_bcn_tasklet is created during rtl_pci_init() and scheduled from the interrupt handler when the hardware raises the RTL_IMR_BCNINT beacon interrupt. The driver's teardown path, rtl_pci_deinit(), fails to call tasklet_kill() for this tasklet. If probe fails or the adapter is detached, the surrounding ieee80211_hw structure is released by mac80211 while the tasklet is still pending or executing on another CPU. When the tasklet body, _rtl_pci_prepare_bcn_tasklet(), dereferences fields hung off the freed ieee80211_hw, the kernel reads or writes memory that may already be reallocated.

The EPSS score is 0.164% (percentile 5.967), reflecting low predicted exploitation activity given the local hardware-dependent attack surface.

Root Cause

The root cause is asymmetric lifecycle management between tasklet initialization and teardown. The companion irq_tasklet is properly killed during deinit, but irq_prepare_bcn_tasklet was omitted. Without tasklet_kill(), the kernel cannot guarantee that pending or in-flight tasklet execution has completed before the owning data structures are freed.

Attack Vector

Triggering the condition requires the device probe to fail or the rtlwifi PCI device to be detached while a beacon interrupt is pending. This is typically reachable through local actions such as unbinding the driver via sysfs, hot-removing the device, module unload, or a probe-time error path. Remote exploitation is not indicated. The realistic impact is kernel memory corruption that can cause a denial of service. Exploitation toward privilege escalation would require precise heap grooming of the freed ieee80211_hw allocation.

No public proof-of-concept code is available. The vulnerability is described in prose by the upstream commit message; see the kernel commits listed in the references for the patch diff.

Detection Methods for CVE-2026-53112

Indicators of Compromise

Kernel oops or panic traces referencing _rtl_pci_prepare_bcn_tasklet, rtl_pci_deinit, or ieee80211_hw dereferences after device removal.
KASAN reports identifying use-after-free reads or writes in the rtlwifi PCI module during driver unbind or probe failure.
Repeated driver probe failures for Realtek PCIe Wi-Fi adapters followed by abnormal dmesg activity from mac80211.

Detection Strategies

Enable Kernel Address Sanitizer (KASAN) on test or canary hosts to catch use-after-free conditions in the rtlwifi code path.
Monitor dmesg and journalctl -k for stack traces involving rtlwifi and mac80211 around device hot-remove or module reload events.
Inventory kernel versions across the fleet and flag hosts running unpatched rtlwifi builds on hardware with Realtek PCI Wi-Fi.

Monitoring Recommendations

Forward kernel logs to a centralized telemetry pipeline and alert on BUG: KASAN, general protection fault, or Oops strings referencing rtlwifi or ieee80211.
Track modprobe, rmmod, and PCI hot-plug events on endpoints with affected hardware to correlate crashes with driver lifecycle activity.
Audit systemd-udev and userspace tooling that may repeatedly bind and unbind the rtlwifi driver, since such patterns increase exposure.

How to Mitigate CVE-2026-53112

Immediate Actions Required

Update the Linux kernel to a stable release that contains the tasklet_kill() addition in rtl_pci_deinit() for the irq_prepare_bcn_tasklet.
On systems that cannot be patched immediately, blacklist or unload the rtlwifi family of modules if the affected Realtek PCI Wi-Fi hardware is not required.
Avoid scripted or automated driver rebind cycles on affected hosts until the patched kernel is deployed.

Patch Information

The upstream fix adds tasklet_kill() for irq_prepare_bcn_tasklet in rtl_pci_deinit(), mirroring the existing handling for irq_tasklet. The fix has been backported across multiple stable trees. Refer to the upstream commits: Kernel commit 008c456, Kernel commit 039cd52, Kernel commit 3c0e8a3, Kernel commit 7731b67, Kernel commit aa10a45, Kernel commit ae10d4a, Kernel commit e408738, and Kernel commit fac1079.

Workarounds

Blacklist the affected rtlwifi PCI sub-driver modules (for example rtl8192ce, rtl8192se, rtl8192de, rtl8821ae) if Realtek PCI Wi-Fi is not in use.
Restrict access to PCI hot-plug and driver bind/unbind sysfs interfaces to root-only and remove unnecessary local accounts from groups that can trigger driver reload.
Prefer a USB Wi-Fi adapter on affected hosts until the patched kernel ships, since the bug is specific to the PCI path.

bash

# Blacklist the rtlwifi PCI sub-drivers until patched kernel is deployed
echo 'blacklist rtl8192ce'  | sudo tee -a /etc/modprobe.d/rtlwifi-cve-2026-53112.conf
echo 'blacklist rtl8192se'  | sudo tee -a /etc/modprobe.d/rtlwifi-cve-2026-53112.conf
echo 'blacklist rtl8192de'  | sudo tee -a /etc/modprobe.d/rtlwifi-cve-2026-53112.conf
echo 'blacklist rtl8821ae'  | sudo tee -a /etc/modprobe.d/rtlwifi-cve-2026-53112.conf
sudo update-initramfs -u
sudo reboot