CVE-2018-21008

What it actually does

Use-after-free in rsi_mac80211_detach allows a local process to reference freed memory structures in the RSI wireless driver, resulting in a kernel denial of service.

Why it matters to the business

Affected Linux systems may experience unexpected crashes or wireless interface instability when the driver is loaded, requiring reboots and potentially interrupting workloads on older kernels.

How an attack unfolds

An attacker with local user privileges loads or unloads the RSI wireless driver module in a way that invokes rsi_mac80211_detach, then reuses the dangling pointer to trigger a kernel panic.

How to fix it

Upgrade the Linux kernel to a version containing commit abd39c6ded9db53aa44c2540092bdd5fb6590fa8 or later; apply distribution backports if available.

How to confirm the fix worked

Verify the running kernel contains the referenced commit or is newer than 4.16.7; attempt to load/unload the rsi91x module and confirm no oops occurs.

Typical attack path

1. Gain local shell access on a system running a vulnerable kernel
2. Trigger detachment of the mac80211 interface for the RSI 91x wireless device
3. Cause the kernel to dereference the already-freed object
4. Induce a crash or system instability

How to detect it

Review kernel logs for oops or panic entries referencing rsi_mac80211_detach or rsi_91x_mac80211.c around the time of any unexplained reboots.

What your security team should do

• Prioritize kernel upgrades on systems exposing wireless interfaces
• Restrict local user privileges where possible until patched
• Monitor vendor kernel update channels for backported fixes