CVE-2026-80939 Overview
CVE-2026-80939 is a Linux kernel vulnerability in the rtw89 PCI Wi-Fi driver. The driver lacks a .shutdown callback, allowing hardware rfkill polling to continue during system reboot. On arm64 platforms, this triggers an asynchronous SError kernel panic when the polling handler issues a Memory-Mapped I/O (MMIO) read against a PCIe device whose link has already been torn down.
Critical Impact
Affected arm64 systems using Realtek Wi-Fi hardware managed by the rtw89 driver can panic during warm reboot, resulting in unclean shutdowns and potential filesystem or workload disruption.
Affected Products
- Linux kernel builds including the rtw89_pci and rtw89_core modules prior to the fix
- arm64 platforms pairing Realtek Wi-Fi (rtw89-family) devices with PCIe
- Distribution kernels tracking the affected mainline commits referenced by the stable tree
Discovery Timeline
- 2026-09-11 - CVE-2026-80939 published to the National Vulnerability Database (NVD)
- 2026-09-14 - Last updated in NVD database
Technical Details for CVE-2026-80939
Vulnerability Analysis
The vulnerability resides in the rtw89 PCI driver used for Realtek 802.11ax Wi-Fi devices. After hardware rfkill polling was introduced, the rfkill_poll workqueue calls into rtw89_core_rfkill_poll(), which ultimately issues an MMIO read through rtw89_pci_ops_read8().
On the reboot path, the kernel invokes device_shutdown(), which calls each driver's .shutdown callback. The .remove handler is not invoked. Because the rtw89 PCI driver had no .shutdown callback registered, the rfkill polling work continued to run while the platform tore down the PCIe link.
Once the link is gone, the next MMIO read from the poll handler targets a non-responding device. On arm64, this condition is surfaced as a fatal asynchronous SError Interrupt, producing a kernel panic with the message Kernel panic - not syncing: Asynchronous SError Interrupt.
Root Cause
The root cause is a missing driver lifecycle hook. Without a .shutdown callback, the driver has no opportunity to quiesce background work such as rfkill polling before the PCIe transport is disabled. The fix adds rtw89_pci_shutdown() and a new RTW89_FLAG_SHUTDOWN flag, mirroring the existing RTW89_FLAG_UNPLUGGED pattern used by the USB variant. When the flag is set, rtw89_ops_rfkill_poll() returns early and no further MMIO access is issued.
Attack Vector
This is a reliability and denial-of-service condition triggered by the normal reboot workflow on affected hardware. It does not require attacker input or network reachability. The vulnerability manifests during warm reboot on arm64 systems with the rtw89_pci driver bound to a Realtek Wi-Fi device. Refer to the Kernel Git Commit c1f214d for the exact code change.
Detection Methods for CVE-2026-80939
Indicators of Compromise
- Kernel log entries containing SError Interrupt on CPU, code 0x00000000be000011, and Asynchronous SError Interrupt during or immediately after a reboot event.
- Stack traces referencing rtw89_pci_ops_read8, rtw89_core_rfkill_poll, rtw89_ops_rfkill_poll, ieee80211_rfkill_poll, cfg80211_rfkill_poll, or rfkill_poll in the events_power_efficient workqueue.
- Unexpected system panics correlated with shutdown or reboot operations on arm64 hosts using Realtek Wi-Fi.
Detection Strategies
- Inventory Linux systems with the rtw89_pci module loaded using lsmod | grep rtw89 and cross-reference kernel version against the fixed commits.
- Aggregate kernel ring buffer output (dmesg, journalctl -k) into centralized logging and alert on the SError signature paired with rtw89 symbols.
- Track reboot-time crashes on arm64 fleets and correlate device model, kernel build, and Wi-Fi chipset.
Monitoring Recommendations
- Forward /var/log/kern.log and journal data to a centralized log platform and build a rule for the SError plus rtw89 symbol combination.
- Monitor host uptime resets and unplanned reboot counters to surface repeat offenders.
- Track kernel package versions across the fleet to identify hosts still exposed to the unpatched rtw89 driver.
How to Mitigate CVE-2026-80939
Immediate Actions Required
- Update to a Linux kernel that includes the fix from the referenced stable commits, then reboot to load the patched image.
- Prioritize arm64 hosts with Realtek Wi-Fi hardware bound to rtw89_pci, since these are the systems where the SError panic is observed.
- Validate the fix by executing a warm reboot cycle after patching and confirming no SError entries appear in kernel logs.
Patch Information
The fix adds rtw89_pci_shutdown() and wires it to all rtw89 PCI device drivers. A new RTW89_FLAG_SHUTDOWN flag prevents rtw89_ops_rfkill_poll() from issuing MMIO reads after shutdown begins. The change is intentionally minimal and does not invoke the full .remove path, avoiding non-idempotent teardown. See Kernel Git Commit 667c127, Kernel Git Commit 9693980, and Kernel Git Commit c1f214d.
Workarounds
- Unload the rtw89_pci module before initiating a reboot using modprobe -r rtw89_pci to stop rfkill polling prior to PCIe teardown.
- Blacklist the rtw89_pci module on affected arm64 hosts where Wi-Fi is not required until the kernel patch is deployed.
- Prefer a full power cycle over warm reboot on affected devices to avoid the transient PCIe link state that triggers the SError.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
