CVE-2026-80940: Linux Kernel rtw88 Privilege Escalation

CVE-2026-80940 Overview

CVE-2026-80940 is a resource leak in the Linux kernel's Realtek rtw88 PCI Wi-Fi driver. The rtw_pci_probe() function allocates PCI resources through rtw_pci_setup_resource() before initializing NAPI. When rtw_pci_napi_init() fails, the error path jumps directly to the err_pci_declaim label and skips rtw_pci_destroy(), leaving the previously allocated PCI resources behind. The fix introduces a dedicated cleanup label so probe correctly tears down PCI resources on the NAPI failure path.

Critical Impact
Repeated probe failures can leak PCI resources in the rtw88 driver, contributing to kernel memory exhaustion on affected systems using Realtek Wi-Fi hardware.

Affected Products

Linux kernel mainline (bug confirmed present through v7.1-rc7 per the upstream commit message)
Systems using the Realtek rtw88 PCI Wi-Fi driver
Downstream distributions shipping affected stable kernel branches

Discovery Timeline

2026-09-11 - CVE-2026-80940 published to NVD
2026-09-11 - Last updated in NVD database

Technical Details for CVE-2026-80940

Vulnerability Analysis

The defect resides in the PCI probe flow of the rtw88 wireless driver. During device initialization, rtw_pci_probe() calls rtw_pci_setup_resource() to allocate PCI-related resources such as I/O mappings and DMA structures. It subsequently invokes rtw_pci_napi_init() to register the NAPI polling context for network receive processing.

If rtw_pci_napi_init() returns an error, execution branches to the err_pci_declaim label. That label does not call rtw_pci_destroy(), so the PCI resources allocated moments earlier remain live in the kernel with no owning driver instance. Each failed probe cycle strands the same set of resources.

The upstream fix adds a dedicated cleanup label for the NAPI failure path that invokes rtw_pci_destroy() before propagating the error, ensuring the driver unwinds initialization in the reverse order it was performed.

Root Cause

The root cause is an incomplete error-handling ladder in rtw_pci_probe(). The existing goto targets did not model the ordering between PCI resource setup and NAPI initialization, so a failure between those two steps skipped a required cleanup call. This is a classic missing-release-on-error-path memory leak in a device driver.

Attack Vector

The issue triggers along the driver probe path and requires rtw_pci_napi_init() to fail. There is no published evidence of remote exploitability or of a practical local attack path. Impact is limited to resource leakage that accumulates across failed probe attempts on hosts with affected Realtek PCI Wi-Fi devices.

No verified exploit code is available. See the upstream patches for the corrected control flow: Kernel Git Commit 34a5050, Kernel Git Commit 481fff9, Kernel Git Commit b1596e2, and Kernel Git Commit e779df4.

Detection Methods for CVE-2026-80940

Indicators of Compromise

Repeated rtw88_pci probe failure messages in dmesg or journalctl -k output referencing NAPI initialization errors.
Growth in kernel slab or DMA allocations attributable to the rtw88 driver across probe retries.
Wi-Fi interface failing to appear after module load despite the PCI device being enumerated by lspci.

Detection Strategies

Audit installed kernel package versions against the fixed commits referenced in the upstream stable branches.
Correlate driver load events with subsequent kernel memory pressure on hosts using Realtek PCI Wi-Fi hardware.
Include the affected commit hashes in kernel patch-compliance scans across managed Linux fleets.

Monitoring Recommendations

Forward kernel logs to a centralized logging platform and alert on repeated rtw88 probe failure sequences.
Track slab statistics from /proc/slabinfo on endpoints where the rtw88 driver is loaded.
Monitor module load and unload events for rtw88_pci to identify hosts experiencing repeated re-probe cycles.

How to Mitigate CVE-2026-80940

Immediate Actions Required

Update to a Linux kernel that includes the upstream fix commits for the rtw88 PCI probe path.
Inventory endpoints and servers using Realtek rtw88-supported PCI Wi-Fi adapters and prioritize them for patching.
On systems that cannot be patched immediately, avoid repeatedly reloading the rtw88_pci module.

Patch Information

The fix is applied across multiple stable branches via these commits: 34a5050, 481fff9, b1596e2, and e779df4. Apply the corresponding stable kernel update from your distribution vendor.

Workarounds

Blacklist the rtw88_pci module on hosts that do not require Realtek Wi-Fi functionality until patched kernels are deployed.
Disable automatic module reload logic in userspace tooling to prevent repeated failed probes from compounding the leak.
Restrict physical or administrative actions that would force PCI rescans on affected hardware.

bash

# Blacklist the affected driver until a patched kernel is installed
echo 'blacklist rtw88_pci' | sudo tee /etc/modprobe.d/blacklist-rtw88.conf
sudo modprobe -r rtw88_pci
sudo update-initramfs -u