CVE-2026-72005 - Vulnerability Details

- wifi: rt2x00: avoid full teardown before work setup in probe

Description

In the Linux kernel, the following vulnerability has been resolved:

wifi: rt2x00: avoid full teardown before work setup in probe

rt2x00lib_probe_dev() uses the full rt2x00lib_remove_dev() teardown for
all probe failures. However, drv_data allocation and workqueue allocation
can fail before intf_work, autowakeup_work and sleep_work have been
initialized.

Do not enter the full remove path until the probe has reached the point
where those work items are set up. Return directly for drv_data allocation
failure, and use a small early cleanup path for workqueue allocation
failure.

This issue was found by our static analysis tool and then confirmed by
manual review of rt2x00lib_probe_dev() and rt2x00lib_remove_dev(). The
early probe exits should not call a common teardown path that assumes the
later work setup has already completed.

A QEMU PoC forced alloc_ordered_workqueue() to fail before the work
initializers are reached. The resulting fail path entered
rt2x00lib_remove_dev(), and DEBUG_OBJECTS reported invalid work drains with
rt2x00lib_probe_dev() and rt2x00lib_remove_dev() in the stack.

Published: 2026-08-15

Score: n/a

EPSS: n/a

KEV: No

Impact:

Action:

Analysis

Impact

The kernel driver rt2x00lib_probe_dev performs a full teardown on probe failures even before the work items are initialized, causing work queues to be drained while referencing uninitialized structures. A proof of concept shows that forcing a work queue allocation failure can trigger a kernel panic or invalidate work drains, as detected by DEBUG_OBJECTS. This bug can potentially lead to a kernel crash and therefore a denial of service on affected systems.

Affected Systems

The flaw is in the Linux kernel's rt2x00 wireless driver. No specific kernel version is listed, so the issue may affect any system running an unpatched kernel that includes the rt2x00 modules.

Risk and Exploitability

The CVSS score is not provided, and no EPSS value is available, making the exact severity difficult to quantify. The bug was discovered by static analysis and confirmed with a QEMU test, indicating that a crafted driver environment can trigger it. Because it requires the driver to be loaded and a probe failure, the attack vector is likely local or within the device context; no remote exploitation vector is documented. The absence from the CISA KEV list suggests that exploited attacks have not been observed yet, but the potential for a kernel crash remains a significant risk for affected deployments.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`0439f5367c8d8bb2ebaca8d7329f51f3148b2fb2`	affected	< 8b58d1f1356df6a7d2de3f55bb665b18b04ffda0
`0439f5367c8d8bb2ebaca8d7329f51f3148b2fb2`	affected	< 59afe6148927395cf86f9429900e029a48b1d42b
`0439f5367c8d8bb2ebaca8d7329f51f3148b2fb2`	affected	< 3c0427d719bddb33caf18ff4ffb77cb47de7eb00
`0439f5367c8d8bb2ebaca8d7329f51f3148b2fb2`	affected	< eb7474d0253bb2de4793e1d3ce833e8564bbe732
`0439f5367c8d8bb2ebaca8d7329f51f3148b2fb2`	affected	< 66bd9b1a72de7c2f5141b02d796048aafaed8a49
`0439f5367c8d8bb2ebaca8d7329f51f3148b2fb2`	affected	< 816559409e340acaa5c9d868291dab30d8c80263
`0439f5367c8d8bb2ebaca8d7329f51f3148b2fb2`	affected	< 56994852d704535ea354a4627ca667b1b4fa0deb
`0439f5367c8d8bb2ebaca8d7329f51f3148b2fb2`	affected	< 536fb3d739d75a03cb318c0c6fe799425cfea501

Linux

affected

Version	Status	Constraints
`2.6.39`	affected	—
`0`	unaffected	< 2.6.39
`5.10.261`	unaffected	≤ 5.10.*
`5.15.212`	unaffected	≤ 5.15.*
`6.1.178`	unaffected	≤ 6.1.*
`6.6.145`	unaffected	≤ 6.6.*
`6.12.97`	unaffected	≤ 6.12.*
`6.18.40`	unaffected	≤ 6.18.*
`7.1.5`	unaffected	≤ 7.1.*
`7.2-rc4`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[0439f5367c8d8bb2ebaca8d7329f51f3148b2fb2,8b58d1f1356df6a7d2de3f55bb665b18b04ffda0)`	affected	code_commit	—
`[0439f5367c8d8bb2ebaca8d7329f51f3148b2fb2,59afe6148927395cf86f9429900e029a48b1d42b)`	affected	code_commit	—
`[0439f5367c8d8bb2ebaca8d7329f51f3148b2fb2,3c0427d719bddb33caf18ff4ffb77cb47de7eb00)`	affected	code_commit	—
`[0439f5367c8d8bb2ebaca8d7329f51f3148b2fb2,eb7474d0253bb2de4793e1d3ce833e8564bbe732)`	affected	code_commit	—
`[0439f5367c8d8bb2ebaca8d7329f51f3148b2fb2,66bd9b1a72de7c2f5141b02d796048aafaed8a49)`	affected	code_commit	—
`[0439f5367c8d8bb2ebaca8d7329f51f3148b2fb2,816559409e340acaa5c9d868291dab30d8c80263)`	affected	code_commit	—
`[0439f5367c8d8bb2ebaca8d7329f51f3148b2fb2,56994852d704535ea354a4627ca667b1b4fa0deb)`	affected	code_commit	—
`[0439f5367c8d8bb2ebaca8d7329f51f3148b2fb2,536fb3d739d75a03cb318c0c6fe799425cfea501)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`2.6.39`	affected	semver	—
`[0,2.6.39)`	unaffected	generic	—
`[5.10.261,5.11.0)`	unaffected	semver	—
`[5.15.212,5.16.0)`	unaffected	semver	—
`[6.1.178,6.2.0)`	unaffected	semver	—
`[6.6.145,6.7.0)`	unaffected	semver	—
`[6.12.97,6.13.0)`	unaffected	semver	—
`[6.18.40,6.19.0)`	unaffected	semver	—
`[7.1.5,7.2.0)`	unaffected	semver	—
`[7.2-rc4,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Upgrade to the latest Linux kernel that contains the rt2x00 probe cleanup fix
If an immediate update is not possible, blacklist or unload the rt2x00 Wi‑Fi driver to prevent the flaw from executing
Monitor kernel logs for DEBUG_OBJECTS work‑queue errors and take corrective action if they appear

Generated by OpenCVE AI on August 15, 2026 at 07:44 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/3c0427d719bddb33caf18ff4ffb77cb47de7eb00
https://git.kernel.org/stable/c/536fb3d739d75a03cb318c0c6fe799425cfea501
https://git.kernel.org/stable/c/56994852d704535ea354a4627ca667b1b4fa0deb
https://git.kernel.org/stable/c/59afe6148927395cf86f9429900e029a48b1d42b
https://git.kernel.org/stable/c/66bd9b1a72de7c2f5141b02d796048aafaed8a49
https://git.kernel.org/stable/c/816559409e340acaa5c9d868291dab30d8c80263
https://git.kernel.org/stable/c/8b58d1f1356df6a7d2de3f55bb665b18b04ffda0
https://git.kernel.org/stable/c/eb7474d0253bb2de4793e1d3ce833e8564bbe732

History

Sat, 15 Aug 2026 08:00:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-457 CWE-703

Sat, 15 Aug 2026 06:00:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: wifi: rt2x00: avoid full teardown before work setup in probe rt2x00lib_probe_dev() uses the full rt2x00lib_remove_dev() teardown for all probe failures. However, drv_data allocation and workqueue allocation can fail before intf_work, autowakeup_work and sleep_work have been initialized. Do not enter the full remove path until the probe has reached the point where those work items are set up. Return directly for drv_data allocation failure, and use a small early cleanup path for workqueue allocation failure. This issue was found by our static analysis tool and then confirmed by manual review of rt2x00lib_probe_dev() and rt2x00lib_remove_dev(). The early probe exits should not call a common teardown path that assumes the later work setup has already completed. A QEMU PoC forced alloc_ordered_workqueue() to fail before the work initializers are reached. The resulting fail path entered rt2x00lib_remove_dev(), and DEBUG_OBJECTS reported invalid work drains with rt2x00lib_probe_dev() and rt2x00lib_remove_dev() in the stack.
Title		wifi: rt2x00: avoid full teardown before work setup in probe
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/3c0427d719bddb33caf18ff4ffb77cb47de7eb00 https://git.kernel.org/stable/c/536fb3d739d75a03cb318c0c6fe799425cfea501 https://git.kernel.org/stable/c/56994852d704535ea354a4627ca667b1b4fa0deb https://git.kernel.org/stable/c/59afe6148927395cf86f9429900e029a48b1d42b https://git.kernel.org/stable/c/66bd9b1a72de7c2f5141b02d796048aafaed8a49 https://git.kernel.org/stable/c/816559409e340acaa5c9d868291dab30d8c80263 https://git.kernel.org/stable/c/8b58d1f1356df6a7d2de3f55bb665b18b04ffda0 https://git.kernel.org/stable/c/eb7474d0253bb2de4793e1d3ce833e8564bbe732

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-08-15T05:51:36.005Z

Updated: 2026-08-15T05:51:36.005Z

Reserved: 2026-08-09T03:40:39.898Z

Link: CVE-2026-72005

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-08-15T06:20:59.113

Modified: 2026-08-15T06:20:59.113

Link: CVE-2026-72005

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-08-15T09:30:04Z

Weaknesses

CWE-457
Use of Uninitialized Variable
CWE-703
Improper Check or Handling of Exceptional Conditions

Impact

Affected Systems

Risk and Exploitability

Tracking

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object