CVE-2026-80947: Linux Kernel rtl8xxxu Use-After-Free

CVE-2026-80947 Overview

CVE-2026-80947 is a use-after-free vulnerability in the Linux kernel's rtl8xxxu Wi-Fi driver, which supports Realtek RTL8xxx USB wireless adapters. The flaw resides in the RX URB workqueue teardown path. When rtl8xxxu_stop() runs during active receive traffic, the rx_urb_wq worker can execute after rtl8xxxu_disconnect() calls ieee80211_free_hw(), freeing the priv structure. The worker then dereferences freed memory through priv->udev. The bug was identified through static analysis and affects Linux kernel builds that include the rtl8xxxu driver.

Critical Impact
A local attacker able to trigger USB Wi-Fi adapter disconnect events during heavy RX traffic can trigger a kernel use-after-free, potentially leading to memory corruption, denial of service, or local privilege escalation.

Affected Products

Linux kernel builds containing the rtl8xxxu USB Wi-Fi driver
Systems using Realtek RTL8xxx-series USB wireless adapters
Distributions shipping kernels prior to the fixes referenced in the stable trees

Discovery Timeline

2026-09-11 - CVE-2026-80947 published to the National Vulnerability Database
2026-09-13 - Last updated in NVD database

Technical Details for CVE-2026-80947

Vulnerability Analysis

The rtl8xxxu driver schedules rx_urb_wq from the RX completion path. rtl8xxxu_rx_complete() passes each USB Request Block (URB) to rtl8xxxu_queue_rx_urb(), which enqueues it on rx_urb_pending_list. Once the pending list exceeds RTL8XXXU_RX_URB_PENDING_WATER, the worker is scheduled. The worker rtl8xxxu_rx_urb_work() drains the list, recovers priv through container_of, and resubmits each URB via rtl8xxxu_submit_rx_urb(), which anchors the URB on rx_anchor and dereferences priv->udev.

rtl8xxxu_stop() cancels sibling work items such as c2hcmd_work, ra_watchdog, and update_beacon_work but never cancels rx_urb_wq. A worker armed during the last burst of RX traffic can therefore run after rtl8xxxu_disconnect() has freed priv, producing the use-after-free.

Root Cause

Two teardown races exist. First, rtl8xxxu_queue_rx_urb() evaluated the shutdown flag under rx_urb_lock but called schedule_work() after releasing the lock, allowing a completion to arm the worker after cancel_work_sync() returned. Second, rtl8xxxu_rx_urb_work() re-anchors drained URBs onto rx_anchor, so a worker still running when usb_kill_anchored_urbs(&priv->rx_anchor) returned would submit URBs that escaped the kill.

Attack Vector

Exploitation requires local access with the ability to induce Wi-Fi driver teardown during active RX traffic. An attacker with physical or logical control over a USB Wi-Fi adapter can trigger disconnect events while the pending URB count exceeds the watermark. The resulting use-after-free operates on kernel memory holding the freed priv structure. Successful exploitation can corrupt kernel state, crash the system, or escalate privileges depending on heap layout and reallocation timing. See the kernel commit 620acb1e for the fix.

Detection Methods for CVE-2026-80947

Indicators of Compromise

Kernel oops or panic messages referencing rtl8xxxu_rx_urb_work, rtl8xxxu_submit_rx_urb, or usb_anchor_urb shortly after a Wi-Fi disconnect event.
KASAN reports flagging use-after-free reads on the priv structure during rx_urb_wq execution.
Unexpected system instability correlated with USB Wi-Fi adapter removal or driver unload on Realtek RTL8xxx devices.

Detection Strategies

Enable Kernel Address Sanitizer (KASAN) on test systems to surface use-after-free access on rx_urb_wq teardown.
Monitor dmesg and journal logs for kernel warnings involving the rtl8xxxu driver following interface stop or USB disconnect events.
Track kernel package versions against the fixed commits published in the stable trees to identify unpatched hosts.

Monitoring Recommendations

Collect kernel crash dumps and forward them to a centralized log aggregation platform for correlation with USB device events.
Audit endpoints that use Realtek USB Wi-Fi adapters and flag hosts running kernels without the referenced stable patches.
Alert on repeated Wi-Fi interface flapping combined with kernel task backtraces referencing workqueue functions in rtl8xxxu.

How to Mitigate CVE-2026-80947

Immediate Actions Required

Apply the upstream Linux kernel patches referenced in the stable commits to systems running the rtl8xxxu driver.
Where patching is delayed, restrict physical and logical access to USB ports on affected hosts to limit the ability to trigger driver teardown.
Inventory endpoints and IoT devices that load the rtl8xxxu module and prioritize kernel updates on multi-user systems.

Patch Information

The fix moves schedule_work() under the !shutdown branch so the arming decision is atomic with the shutdown check, and adds cancel_work_sync(&priv->rx_urb_wq) in rtl8xxxu_stop() before usb_kill_anchored_urbs(). Fixed commits are available at 620acb1e, 6c080026, 800d2b49, and 972ab8b9.

Workarounds

Blacklist the rtl8xxxu kernel module on hosts that do not require Realtek USB Wi-Fi functionality until patched kernels are deployed.
Use an alternative supported wireless driver or a wired network interface where operationally feasible.
Avoid disconnecting or physically removing Realtek USB Wi-Fi adapters during active traffic on unpatched systems.

bash

# Blacklist the vulnerable driver until the kernel is patched
echo "blacklist rtl8xxxu" | sudo tee /etc/modprobe.d/blacklist-rtl8xxxu.conf
sudo modprobe -r rtl8xxxu
sudo update-initramfs -u