Skip to main content
cve.nowby Sazabi
← All vulnerabilities
CVE-2026-46187

wifi: rsi: fix kthread lifetime race between self-exit and external-stop

Published
Last modified
published
Not listed in CISA KEV
Fix
Fixed in 3.19, 4.5, 4.10, 4.15, 4.20, and 7 more
None on Exploit-DB, Metasploit or GitHub

Summary

In the Linux kernel, the following vulnerability has been resolved: wifi: rsi: fix kthread lifetime race between self-exit and external-stop RSI driver use both self-exit(kthread_complete_and_exit) and external-stop (kthread_stop) when killing a kthread. Generally, kthread_stop() is called first, and in this case, no particular issues occur. However, in rare instances where kthread_complete_and_exit() is called first and then kthread_stop() is called, a UAF occurs because the kthread object, which has already exited and been freed, is accessed again. Therefore, to prevent this with minimal modification, you must remove kthread_stop() and change the code to wait until the self-exit operation is completed.

Timeline

  1. CVE published
  2. Record last updated

Affected versions

  • Linux Linux

    From 4c62764d0fc21a34ffc44eec1210038c3a2e4473 · fixed in 4ac3095da22fc50e51ec10c3b8323c21ab3e441a; From 4c62764d0fc21a34ffc44eec1210038c3a2e4473 · fixed in 9dfe8a4458a063c6433526bc59112a169eee1aa3; From 4c62764d0fc21a34ffc44eec1210038c3a2e4473 · fixed in 4f697813162d5f9151726a6d2bee82bffe4b0256; From 4c62764d0fc21a34ffc44eec1210038c3a2e4473 · fixed in 95fcb436586dc3c2983537d557ac05bbc6a027f3; From 4c62764d0fc21a34ffc44eec1210038c3a2e4473 · fixed in 16d9f674c619838bdeae42abc0929c9c5477ea1f; From 4c62764d0fc21a34ffc44eec1210038c3a2e4473 · fixed in 4f9a4ae8d2c198f01611ea376034c326ef43ab56; From 4c62764d0fc21a34ffc44eec1210038c3a2e4473 · fixed in 4f4c9b13c485abd0a2d2c97f9db339d1dd8e147f; From 4c62764d0fc21a34ffc44eec1210038c3a2e4473 · fixed in db57a1aa54ff68669781976e4edb045e09e2b65b; From 3.18.139 · fixed in 3.19; From 4.4.179 · fixed in 4.5; From 4.9.170 · fixed in 4.10; From 4.14.113 · fixed in 4.15; From 4.19.36 · fixed in 4.20

  • Linux Linux

    4.20

  • KernelLinux

    From 4.20.0 · fixed in 5.10.258; From 5.11.0 · fixed in 5.15.209; From 5.16.0 · fixed in 6.1.175; From 6.2.0 · fixed in 6.6.140; From 6.7.0 · fixed in 6.12.88; From 6.13.0 · fixed in 6.18.30; From 6.19.0 · fixed in 7.0.7

References 8

git.kernel.org