Skip to content
OpenAdvisories
Unscored CVE-2023-53452 EUVD-2025-32819GHSA-77qf-55vf-5v3v

wifi: rtw89: fix potential race condition between napi_init and napi_enable

Published Oct 1, 2025 · Updated Nov 5, 2026 · Assigned by Linux

Vendor: Linux Product: Linux Package: linux Package: linux Package: linux-allwinner-5.19 Package: linux-aws Package: linux-aws-5.0 Package: linux-aws-5.11 Package: linux-aws-5.13 Package: linux-aws-5.15 Package: linux-aws-5.19 Package: linux-aws-5.3 Package: linux-aws-5.8 Package: linux-aws-6.2 Package: linux-aws-6.5 Package: linux-aws-fips Package: linux-azure Package: linux-azure-5.11 Package: linux-azure-5.13 Package: linux-azure-5.15 Package: linux-azure-5.19 Package: linux-azure-5.3 Package: linux-azure-5.8 Package: linux-azure-6.11 Package: linux-azure-6.2 Package: linux-azure-6.5 Package: linux-azure-edge Package: linux-azure-fde Package: linux-azure-fde-5.15 Package: linux-azure-fde-5.19 Package: linux-azure-fde-6.2 Package: linux-azure-fips Package: linux-bluefield Package: linux-fips Package: linux-gcp Package: linux-gcp-5.11 Package: linux-gcp-5.13 Package: linux-gcp-5.15 Package: linux-gcp-5.19 Package: linux-gcp-5.3 Package: linux-gcp-5.8 Package: linux-gcp-6.11 Package: linux-gcp-6.2 Package: linux-gcp-6.5 Package: linux-gcp-fips Package: linux-gke Package: linux-gke-4.15 Package: linux-gke-5.15 Package: linux-gke-5.4 Package: linux-gkeop Package: linux-gkeop-5.15 Package: linux-gkeop-5.4 Package: linux-hwe Package: linux-hwe-5.11 Package: linux-hwe-5.13 Package: linux-hwe-5.15 Package: linux-hwe-5.19 Package: linux-hwe-5.8 Package: linux-hwe-6.11 Package: linux-hwe-6.2 Package: linux-hwe-6.5 Package: linux-hwe-edge Package: linux-ibm Package: linux-ibm-5.15 Package: linux-intel Package: linux-intel-5.13 Package: linux-intel-iot-realtime Package: linux-intel-iotg Package: linux-intel-iotg-5.15 Package: linux-kvm Package: linux-lowlatency Package: linux-lowlatency-hwe-5.15 Package: linux-lowlatency-hwe-5.19 Package: linux-lowlatency-hwe-6.11 Package: linux-lowlatency-hwe-6.2 Package: linux-lowlatency-hwe-6.5 Package: linux-nvidia Package: linux-nvidia-6.2 Package: linux-nvidia-6.5 Package: linux-nvidia-tegra Package: linux-nvidia-tegra-5.15 Package: linux-nvidia-tegra-igx Package: linux-oem Package: linux-oem-5.10 Package: linux-oem-5.13 Package: linux-oem-5.14 Package: linux-oem-5.17 Package: linux-oem-5.6 Package: linux-oem-6.0 Package: linux-oem-6.1 Package: linux-oem-6.11 Package: linux-oem-6.5 Package: linux-oem-6.8 Package: linux-oracle Package: linux-oracle-5.0 Package: linux-oracle-5.11 Package: linux-oracle-5.13 Package: linux-oracle-5.15 Package: linux-oracle-5.3 Package: linux-oracle-5.8 Package: linux-oracle-6.5 Package: linux-raspi Package: linux-raspi-realtime Package: linux-raspi2 Package: linux-realtime Package: linux-riscv Package: linux-riscv-5.11 Package: linux-riscv-5.15 Package: linux-riscv-5.19 Package: linux-riscv-5.8 Package: linux-riscv-6.5 Package: linux-starfive-5.19 Package: linux-starfive-6.2 Package: linux-starfive-6.5 Package: linux-vmware Package: linux-xilinx-zynqmp Platform: Linux Ecosystem: Debian Ecosystem: Ubuntu

Description

In the Linux kernel, the following vulnerability has been resolved:

wifi: rtw89: fix potential race condition between napi_init and napi_enable

A race condition can happen if netdev is registered, but NAPI isn't
initialized yet, and meanwhile user space starts the netdev that will
enable NAPI. Then, it hits BUG_ON():

kernel BUG at net/core/dev.c:6423!
invalid opcode: 0000 [#1] PREEMPT SMP NOPTI
CPU: 0 PID: 417 Comm: iwd Not tainted 6.2.7-slab-dirty #3 eb0f5a8a9d91
Hardware name: LENOVO 21DL/LNVNB161216, BIOS JPCN20WW(V1.06) 09/20/2022
RIP: 0010:napi_enable+0x3f/0x50
Code: 48 89 c2 48 83 e2 f6 f6 81 89 08 00 00 02 74 0d 48 83 ...
RSP: 0018:ffffada1414f3548 EFLAGS: 00010246
RAX: 0000000000000000 RBX: ffffa01425802080 RCX: 0000000000000000
RDX: 00000000000002ff RSI: ffffada14e50c614 RDI: ffffa01425808dc0
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000001 R11: 0000000000000100 R12: ffffa01425808f58
R13: 0000000000000000 R14: ffffa01423498940 R15: 0000000000000001
FS: 00007f5577c0a740(0000) GS:ffffa0169fc00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f5577a19972 CR3: 0000000125a7a000 CR4: 0000000000750ef0
PKRU: 55555554
Call Trace:
<TASK>
rtw89_pci_ops_start+0x1c/0x70 [rtw89_pci 6cbc75429515c181cbc386478d5cfb32ffc5a0f8]
rtw89_core_start+0xbe/0x160 [rtw89_core fe07ecb874820b6d778370d4acb6ef8a37847f22]
rtw89_ops_start+0x26/0x40 [rtw89_core fe07ecb874820b6d778370d4acb6ef8a37847f22]
drv_start+0x42/0x100 [mac80211 c07fa22af8c3cf3f7d7ab3884ca990784d72e2d2]
ieee80211_do_open+0x311/0x7d0 [mac80211 c07fa22af8c3cf3f7d7ab3884ca990784d72e2d2]
ieee80211_open+0x6a/0x90 [mac80211 c07fa22af8c3cf3f7d7ab3884ca990784d72e2d2]
__dev_open+0xe0/0x180
__dev_change_flags+0x1da/0x250
dev_change_flags+0x26/0x70
do_setlink+0x37c/0x12c0
? ep_poll_callback+0x246/0x290
? __nla_validate_parse+0x61/0xd00
? __wake_up_common_lock+0x8f/0xd0

To fix this, follow Jonas' suggestion to switch the order of these
functions and move register netdev to be the last step of PCI probe.
Also, correct the error handling of rtw89_core_register_hw().

Affected products

VendorProductAffectedFixed
Linux Linux 5.16 6.1.28

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 linux 6.3.7-1 —
Debian 13 linux 6.3.7-1 —
Debian 12 linux 6.1.37-1 —
ReleasePackageFixed inAdvisory
Ubuntu Nvidia-BlueField 22.04 LTS linux-bluefield No fix yet —
Ubuntu 24.04 LTS linux-intel +9 No fix yet —
Ubuntu 22.04 LTS linux +49 No fix yet —
Ubuntu 20.04 LTS linux-gke +28 No fix yet —
Ubuntu 18.04 LTS linux-gcp +14 No fix yet —
Show 5 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu 16.04 LTS linux-hwe-edge No fix yet —
Ubuntu Pro Realtime 22.04 LTS linux-realtime +1 No fix yet —
Ubuntu Pro FIPS-updates 22.04 LTS linux-fips +3 No fix yet —
Ubuntu Pro FIPS-preview 22.04 LTS linux-fips +3 No fix yet —
Ubuntu Pro 20.04 LTS linux-aws-5.15 +10 No fix yet —
ReleasePackageFixed inAdvisory
SLES 15 SP5 kernel-64kb +6 5.14.21-150500.55.124.1 SUSE-SU-2025:03615-1
SLES 15 SP5 kernel-default-base 5.14.21-150500.55.124.1.150500.6.59.1 SUSE-SU-2025:03615-1
SLES 15 SP4 kernel-64kb +6 5.14.21-150400.24.179.1 SUSE-SU-2025:03628-1
SLES 15 SP4 kernel-default-base 5.14.21-150400.24.179.1.150400.24.92.1 SUSE-SU-2025:03628-1
Show 11 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES for SAP 15 SP5 kernel-default-base 5.14.21-150500.55.124.1.150500.6.59.1 SUSE-SU-2025:03615-1
SLES for SAP 15 SP5 kernel-docs +4 5.14.21-150500.55.124.1 SUSE-SU-2025:03615-1
SLES for SAP 15 SP4 kernel-default-base 5.14.21-150400.24.179.1.150400.24.92.1 SUSE-SU-2025:03628-1
SLES for SAP 15 SP4 kernel-docs +4 5.14.21-150400.24.179.1 SUSE-SU-2025:03628-1
SLE Micro 5.5 kernel-default-base 5.14.21-150500.55.124.1.150500.6.59.1 SUSE-SU-2025:03615-1
SLE Micro 5.5 kernel-rt +1 5.14.21-150500.13.109.1 SUSE-SU-2025:3761-1
SLE Micro 5.5 kernel-source +1 5.14.21-150500.55.124.1 SUSE-SU-2025:03615-1
SLE Micro 5.4 kernel-default 5.14.21-150400.24.179.1 SUSE-SU-2025:03628-1
SLE Micro 5.4 kernel-default-base 5.14.21-150400.24.179.1.150400.24.92.1 SUSE-SU-2025:03628-1
SLE Micro 5.4 kernel-rt +1 5.14.21-150400.15.133.1 SUSE-SU-2025:3716-1
SLE Micro 5.3 kernel-default 5.14.21-150400.24.179.1 SUSE-SU-2025:03628-1
SLE Micro 5.3 kernel-default-base 5.14.21-150400.24.179.1.150400.24.92.1 SUSE-SU-2025:03628-1
SLE Micro 5.3 kernel-rt +1 5.14.21-150400.15.133.1 SUSE-SU-2025:3716-1
SLE Live Patching 15 SP5 kernel-default 5.14.21-150500.55.124.1 SUSE-SU-2025:03615-1
SLE Live Patching 15 SP5 kernel-livepatch-SLE15-SP5_Update_31 1-150500.11.3.1 SUSE-SU-2025:03615-1
SLE Live Patching 15 SP4 kernel-default 5.14.21-150400.24.179.1 SUSE-SU-2025:03628-1
SLE Live Patching 15 SP4 kernel-livepatch-SLE15-SP4_Update_45 1-150400.9.3.1 SUSE-SU-2025:03628-1
SLE HPC 15 SP5 kernel-64kb +5 5.14.21-150500.55.124.1 SUSE-SU-2025:03615-1
SLE HPC 15 SP5 kernel-default-base 5.14.21-150500.55.124.1.150500.6.59.1 SUSE-SU-2025:03615-1
SLE HPC 15 SP4 kernel-64kb +5 5.14.21-150400.24.179.1 SUSE-SU-2025:03628-1
SLE HPC 15 SP4 kernel-default-base 5.14.21-150400.24.179.1.150400.24.92.1 SUSE-SU-2025:03628-1
SUSE Manager Server LTS 4.3 kernel-default-base 5.14.21-150400.24.179.1.150400.24.92.1 SUSE-SU-2025:03628-1
SUSE Manager Server LTS 4.3 kernel-syms +3 5.14.21-150400.24.179.1 SUSE-SU-2025:03628-1
SUSE Manager Proxy LTS 4.3 kernel-default-base 5.14.21-150400.24.179.1.150400.24.92.1 SUSE-SU-2025:03628-1
SUSE Manager Proxy LTS 4.3 kernel-syms +2 5.14.21-150400.24.179.1 SUSE-SU-2025:03628-1

Advisories 5

References