Description
In the Linux kernel, the following vulnerability has been resolved:

wifi: rt2x00: avoid full teardown before work setup in probe

rt2x00lib_probe_dev() uses the full rt2x00lib_remove_dev() teardown for
all probe failures. However, drv_data allocation and workqueue allocation
can fail before intf_work, autowakeup_work and sleep_work have been
initialized.

Do not enter the full remove path until the probe has reached the point
where those work items are set up. Return directly for drv_data allocation
failure, and use a small early cleanup path for workqueue allocation
failure.

This issue was found by our static analysis tool and then confirmed by
manual review of rt2x00lib_probe_dev() and rt2x00lib_remove_dev(). The
early probe exits should not call a common teardown path that assumes the
later work setup has already completed.

A QEMU PoC forced alloc_ordered_workqueue() to fail before the work
initializers are reached. The resulting fail path entered
rt2x00lib_remove_dev(), and DEBUG_OBJECTS reported invalid work drains with
rt2x00lib_probe_dev() and rt2x00lib_remove_dev() in the stack.
Published: 2026-08-15
Score: 7.8 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The rt2x00 wireless driver in the Linux kernel has a flaw in its probe routine. When driver data allocation or work queue allocation fails early, the routine mistakenly invokes the full teardown path that expects work items to be initialized. This mismatch leads to dereferencing of uninitialized structures, resulting in a kernel panic that can prevent the system from booting or functioning normally.

Affected Systems

Any Linux system whose kernel contains the rt2x00 driver and has not applied the recent patch is affected. The issue applies to all kernel versions prior to the fix, regardless of whether the system is using a standard distribution kernel or a custom build.

Risk and Exploitability

The CVSS base score of 7.8 indicates high severity, but the EPSS score of less than 1% suggests a low probability of exploitation in the wild. The likely attack vector is local or physical access needed to force a probe failure—this inference is drawn from the description that the flaw manifests during driver initialization. If successfully triggered, the improper teardown can cause a kernel panic, leading to a denial of service. The issue is not listed in CISA KEV, implying no known active exploitation.

Generated by OpenCVE AI on August 18, 2026 at 06:50 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the kernel to a version that includes the rt2x00 driver patch
  • If an upgrade is not immediately possible, blacklist the rt2x00 module to prevent it from loading at boot
  • Monitor kernel logs for "invalid work drain" messages and reboot the system if a crash occurs

Generated by OpenCVE AI on August 18, 2026 at 06:50 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 18 Aug 2026 05:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-665

Tue, 18 Aug 2026 00:15:00 +0000


Mon, 17 Aug 2026 21:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-665

Mon, 17 Aug 2026 19:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-457
CWE-703

Mon, 17 Aug 2026 06:00:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}


Sat, 15 Aug 2026 08:00:00 +0000

Type Values Removed Values Added
Weaknesses CWE-457
CWE-703

Sat, 15 Aug 2026 06:00:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: wifi: rt2x00: avoid full teardown before work setup in probe rt2x00lib_probe_dev() uses the full rt2x00lib_remove_dev() teardown for all probe failures. However, drv_data allocation and workqueue allocation can fail before intf_work, autowakeup_work and sleep_work have been initialized. Do not enter the full remove path until the probe has reached the point where those work items are set up. Return directly for drv_data allocation failure, and use a small early cleanup path for workqueue allocation failure. This issue was found by our static analysis tool and then confirmed by manual review of rt2x00lib_probe_dev() and rt2x00lib_remove_dev(). The early probe exits should not call a common teardown path that assumes the later work setup has already completed. A QEMU PoC forced alloc_ordered_workqueue() to fail before the work initializers are reached. The resulting fail path entered rt2x00lib_remove_dev(), and DEBUG_OBJECTS reported invalid work drains with rt2x00lib_probe_dev() and rt2x00lib_remove_dev() in the stack.
Title wifi: rt2x00: avoid full teardown before work setup in probe
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Subscriptions

Linux Linux Kernel
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-08-17T05:39:22.758Z

Reserved: 2026-08-09T03:40:39.898Z

Link: CVE-2026-72005

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-08-15T06:20:59.113

Modified: 2026-08-17T06:17:57.943

Link: CVE-2026-72005

cve-icon Redhat

Severity : Low

Publid Date: 2026-08-15T00:00:00Z

Links: CVE-2026-72005 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-08-18T07:00:11Z

Weaknesses
  • CWE-908

    Use of Uninitialized Resource