CVE-2026-80942: Linux Kernel RTL8192DU Use-After-Free Vulnerability

CVE-2026-80942 Overview

CVE-2026-80942 is a memory leak vulnerability in the Linux kernel's rtlwifi driver for the Realtek RTL8192DU USB wireless adapter. The flaw resides in the rtl92du_init_sw_vars() initialization function. Memory allocated inside rtl92du_init_shared_data() is not released when subsequent error paths in rtl92du_init_sw_vars() are taken. Repeated driver initialization failures leak kernel memory over time. The upstream fix adds a call to rtl92du_deinit_shared_data() on the error path to release the shared data allocation.

Critical Impact
Repeated failure paths during RTL8192DU wireless driver initialization leak kernel memory, gradually consuming system resources on affected Linux hosts.

Affected Products

Linux kernel branches containing the rtlwifi driver for the Realtek RTL8192DU chipset
Systems using USB wireless adapters based on the Realtek RTL8192DU
Distributions shipping vulnerable stable kernels prior to the fixes referenced in commits 3a5b23e, 6496ce9, 7159e1e, and dc8b0be

Discovery Timeline

2026-09-11 - CVE-2026-80942 published to NVD
2026-09-11 - Last updated in NVD database

Technical Details for CVE-2026-80942

Vulnerability Analysis

The defect is a classic missing-cleanup memory leak inside a kernel driver initialization routine. rtl92du_init_sw_vars() calls rtl92du_init_shared_data(), which allocates memory used by both physical function instances of the RTL8192DU dual-band device. If any later step in rtl92du_init_sw_vars() fails, the function returns without freeing that shared allocation.

Each failed initialization cycle leaks the shared data buffer. In practice, this occurs when the USB adapter is repeatedly plugged in and encounters initialization errors, or when driver load is retried under resource pressure. The leaked memory is not reachable after the failure and accumulates until reboot.

Root Cause

The root cause is an incomplete error-handling contract in rtl92du_init_sw_vars(). The success path relies on later teardown code to release the shared allocation, but no goto err-style unwind restores the pre-call state on failure. The fix introduces an explicit rtl92du_deinit_shared_data() call in the error path to symmetrically release what rtl92du_init_shared_data() acquired [CWE-401: Missing Release of Memory after Effective Lifetime].

Attack Vector

Exploitation requires a condition that forces rtl92du_init_sw_vars() down an error path after the shared allocation succeeds. A local user with physical access to a USB port, or a compromised peripheral, could repeatedly trigger driver initialization failures against an RTL8192DU adapter. The result is progressive kernel memory exhaustion rather than code execution or privilege escalation. There is no evidence of exploitation in the wild, and no public proof-of-concept is referenced in the advisory data.

The vulnerability is described in prose only; see the upstream kernel commits 3a5b23e, 6496ce9, 7159e1e, and dc8b0be for the exact source-level change.

Detection Methods for CVE-2026-80942

Indicators of Compromise

Kernel log entries from the rtl8192du module reporting initialization failures during USB device probe
Repeated usb disconnect and reconnect events for a Realtek RTL8192DU adapter followed by driver init errors
Growth in Slab and unreclaimable kernel memory reported by /proc/meminfo without a corresponding workload change

Detection Strategies

Inventory Linux endpoints and servers for the rtl8192du module using lsmod and correlate with kernel version to identify unpatched hosts
Monitor dmesg and journalctl -k for repeated rtl8192du probe failures that indicate the leaking code path is being exercised
Track long-term kernel memory usage trends on hosts with RTL8192DU adapters to identify slow leaks

Monitoring Recommendations

Forward kernel logs to a centralized logging or SIEM platform and alert on repeated rtlwifi or rtl8192du initialization errors
Baseline kernel Slab and SUnreclaim metrics per host and alert on sustained upward drift
Audit USB device connection events on systems where wireless adapters are not expected, since the affected code path is only reachable when the RTL8192DU driver is loaded

How to Mitigate CVE-2026-80942

Immediate Actions Required

Apply the stable kernel updates that include commits 3a5b23e, 6496ce9, 7159e1e, and dc8b0be for your distribution
Reboot affected hosts after patching to clear any kernel memory previously leaked by the vulnerable code path
On systems where the RTL8192DU adapter is not required, blacklist the rtl8192du module to remove exposure entirely

Patch Information

The fix adds rtl92du_deinit_shared_data() to the error path of rtl92du_init_sw_vars() so that memory allocated by rtl92du_init_shared_data() is released on failure. The change is present in the following upstream commits: 3a5b23e, 6496ce9, 7159e1e, and dc8b0be. Consume the fix through your Linux distribution's stable kernel updates.

Workarounds

Blacklist the rtl8192du kernel module on systems that do not require the affected wireless adapter
Physically remove or disable RTL8192DU USB adapters until the kernel is updated
Restrict physical and USB port access on multi-user systems to reduce the chance that failure paths are triggered repeatedly

bash

# Blacklist the vulnerable driver until the kernel is patched
echo "blacklist rtl8192du" | sudo tee /etc/modprobe.d/blacklist-rtl8192du.conf
sudo modprobe -r rtl8192du 2>/dev/null || true
sudo update-initramfs -u