{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2023-54071", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-12-24T12:21:05.093Z", "datePublished": "2025-12-24T12:23:14.874Z", "dateUpdated": "2026-08-05T09:16:57.302Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T09:16:57.302Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: rtw88: use work to update rate to avoid RCU warning\n\nThe ieee80211_ops::sta_rc_update must be atomic, because\nieee80211_chan_bw_change() holds rcu_read lock while calling\ndrv_sta_rc_update(), so create a work to do original things.\n\n Voluntary context switch within RCU read-side critical section!\n WARNING: CPU: 0 PID: 4621 at kernel/rcu/tree_plugin.h:318\n rcu_note_context_switch+0x571/0x5d0\n CPU: 0 PID: 4621 Comm: kworker/u16:2 Tainted: G W OE\n Workqueue: phy3 ieee80211_chswitch_work [mac80211]\n RIP: 0010:rcu_note_context_switch+0x571/0x5d0\n Call Trace:\n \n __schedule+0xb0/0x1460\n ? __mod_timer+0x116/0x360\n schedule+0x5a/0xc0\n schedule_timeout+0x87/0x150\n ? trace_raw_output_tick_stop+0x60/0x60\n wait_for_completion_timeout+0x7b/0x140\n usb_start_wait_urb+0x82/0x160 [usbcore\n usb_control_msg+0xe3/0x140 [usbcore\n rtw_usb_read+0x88/0xe0 [rtw_usb\n rtw_usb_read8+0xf/0x10 [rtw_usb\n rtw_fw_send_h2c_command+0xa0/0x170 [rtw_core\n rtw_fw_send_ra_info+0xc9/0xf0 [rtw_core\n drv_sta_rc_update+0x7c/0x160 [mac80211\n ieee80211_chan_bw_change+0xfb/0x110 [mac80211\n ieee80211_change_chanctx+0x38/0x130 [mac80211\n ieee80211_vif_use_reserved_switch+0x34e/0x900 [mac80211\n ieee80211_link_use_reserved_context+0x88/0xe0 [mac80211\n ieee80211_chswitch_work+0x95/0x170 [mac80211\n process_one_work+0x201/0x410\n worker_thread+0x4a/0x3b0\n ? process_one_work+0x410/0x410\n kthread+0xe1/0x110\n ? kthread_complete_and_exit+0x20/0x20\n ret_from_fork+0x1f/0x30\n " } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:A - The trigger is an 802.11 frame — a Channel Switch Announcement or a bandwidth change advertised in a beacon/action frame by the AP the station is associated with — processed by `ieee80211_chswitch_work`, so the attacker must be within radio range or operating a rogue AP. Per kernel guidance, WiFi frame injection is Adjacent.\nAC:L - Every bandwidth-changing channel switch deterministically drives the sleeping USB control transfer into mac80211's RCU read-side critical section, and the attacker can repeat it at will by re-advertising CSA/bandwidth changes. The UAF variant's second side is equally attacker-controlled — a spoofed deauth forces the concurrent `sta_info` teardown — so both halves of the race are attacker-driven.\nPR:N - No credentials on the victim system are needed; beacon CSA elements are unprotected even under MFP, and an attacker-operated or spoofed AP reaches the path without any authentication to the target host.\nUI:N - A station that is merely associated or scanning processes the beacon/CSA automatically; no victim action such as opening a file or mounting a filesystem is required.\nS:U - The atomicity violation, RCU stall, and resulting memory corruption are all confined to the kernel's own security authority, with no crossing of a VM, IOMMU, or sandbox boundary.\nC:H - Sleeping inside `rcu_read_lock()` breaks the RCU guarantee on non-preemptible kernels, allowing the grace period to elapse and `sta_info` objects on `local->sta_list` to be freed while the loop still dereferences them — a use-after-free read that per kernel guidance is scored High.\nI:H - The same traversal writes through the potentially freed pointer (`link_sta->pub->bandwidth = new_sta_bw`), giving a UAF write primitive, and the missing `rtwdev->mutex` lets unserialized H2C mailbox/register writes race and corrupt firmware command state.\nA:H - The path produces a kernel WARNING (fatal under `panic_on_warn`) plus \"scheduling while atomic\" on non-preemptible builds, stalls RCU grace periods for seconds per station causing RCU CPU stall warnings and callback backlog, and can crash outright via the use-after-free." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/net/wireless/realtek/rtw88/mac80211.c", "drivers/net/wireless/realtek/rtw88/main.c", "drivers/net/wireless/realtek/rtw88/main.h" ], "versions": [ { "version": "c1edc86472fc3a5aa3b5c5c53c4e20f6a24992a6", "lessThan": "107677a8f43521e33e4a653e50fdf55ba622a4ce", "status": "affected", "versionType": "git" }, { "version": "c1edc86472fc3a5aa3b5c5c53c4e20f6a24992a6", "lessThan": "dd3af22323e79a2ffabed366db20aab83716fe6f", "status": "affected", "versionType": "git" }, { "version": "c1edc86472fc3a5aa3b5c5c53c4e20f6a24992a6", "lessThan": "bcafcb959a57a6890e900199690c5fc47da1a304", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/net/wireless/realtek/rtw88/mac80211.c", "drivers/net/wireless/realtek/rtw88/main.c", "drivers/net/wireless/realtek/rtw88/main.h" ], "versions": [ { "version": "5.19", "status": "affected" }, { "version": "0", "lessThan": "5.19", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.30", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.3.4", "lessThanOrEqual": "6.3.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.4", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.19", "versionEndExcluding": "6.1.30" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.19", "versionEndExcluding": "6.3.4" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.19", "versionEndExcluding": "6.4" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/107677a8f43521e33e4a653e50fdf55ba622a4ce" }, { "url": "https://git.kernel.org/stable/c/dd3af22323e79a2ffabed366db20aab83716fe6f" }, { "url": "https://git.kernel.org/stable/c/bcafcb959a57a6890e900199690c5fc47da1a304" } ], "title": "wifi: rtw88: use work to update rate to avoid RCU warning", "x_generator": { "engine": "bippy-1.2.0" } } } }