{
  "affected": [
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:12",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:13",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:14",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:  wifi: rtl8xxxu: fix use-after-free from rx_urb_wq on stop  rtl8xxxu arms rx_urb_wq from the RX completion path: rtl8xxxu_rx_complete() hands the URB to rtl8xxxu_queue_rx_urb(), which queues it on rx_urb_pending_list and, once the list grows past RTL8XXXU_RX_URB_PENDING_WATER, schedules rx_urb_wq.  The worker rtl8xxxu_rx_urb_work() drains rx_urb_pending_list, recovers priv through container_of, and resubmits each URB through rtl8xxxu_submit_rx_urb(), which anchors it on rx_anchor and dereferences priv-\u003eudev.  rtl8xxxu_stop() cancels the sibling work items (c2hcmd_work, ra_watchdog, update_beacon_work) but never cancels rx_urb_wq, so a worker armed during the last burst of RX traffic can run rtl8xxxu_rx_urb_work() after rtl8xxxu_disconnect() has called ieee80211_free_hw(), which frees priv, producing a use-after-free.  The window opens under active RX traffic (pending count above the watermark) followed by a disconnect.  There are two teardown races to close:    * rtl8xxxu_queue_rx_urb() decided whether to enqueue under rx_urb_lock     but called schedule_work() after dropping the lock.  A completion     that observed shutdown == false and released the lock could then call     schedule_work() after rtl8xxxu_stop() had set shutdown and     cancel_work_sync() had already returned, arming the worker to run     after the teardown.  Move schedule_work() under the same !shutdown     branch so the arming decision is atomic with the shutdown check.    * rtl8xxxu_rx_urb_work() anchors every URB it drained back onto     rx_anchor through rtl8xxxu_submit_rx_urb().  A worker still running     when usb_kill_anchored_urbs(\u0026priv-\u003erx_anchor) returned would submit a     URB that escaped the kill.  In rtl8xxxu_stop(), call     cancel_work_sync(\u0026priv-\u003erx_urb_wq) before the kill so the worker is     drained first.  After priv-\u003eshutdown is set under rx_urb_lock, completions can no longer queue rx_urb_wq. cancel_work_sync() then drains the last queued or running worker, and the following usb_kill_anchored_urbs() kills the URBs it may have submitted.  rtl8xxxu_disconnect() is covered because ieee80211_unregister_hw() guarantees .stop() runs for a live interface before ieee80211_free_hw() frees priv.  The probe error path needs no cancel: rx_urb_wq is INIT_WORK()'d there but cannot have been scheduled, since no URB is submitted before ieee80211_register_hw() succeeds.  This bug was found by static analysis.",
  "id": "DEBIAN-CVE-2026-80947",
  "modified": "2026-09-14T08:47:43.419957229Z",
  "published": "2026-09-11T20:19:00.303Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://security-tracker.debian.org/tracker/CVE-2026-80947"
    }
  ],
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "upstream": [
    "CVE-2026-80947"
  ]
}