CVE-2022-3110

What it actually does

Missing null check on return value of rtw_alloc_hwxmits() in _rtw_init_xmit_priv leads to null pointer dereference in the r8188eu staging driver.

Why it matters to the business

Systems using affected Realtek USB wireless adapters may experience unexpected kernel crashes, reducing availability and requiring reboots or hardware replacement.

How an attack unfolds

An attacker with local user privileges triggers the xmit initialization path under conditions where memory allocation fails, dereferencing a null pointer and causing denial of service.

How to fix it

Upgrade the Linux kernel to a patched release containing the missing return-value check in drivers/staging/r8188eu/core/rtw_xmit.c; disable the r8188eu module if the hardware is not required.

How to confirm the fix worked

Verify the presence of the null check after the rtw_alloc_hwxmits call in the running kernel source or binary; confirm the driver is not loaded on affected hardware.

Typical attack path

1. Obtain local shell access as a non-privileged user
2. Load or exercise the r8188eu driver through wireless configuration or packet transmission attempts
3. Induce allocation failure in rtw_alloc_hwxmits to reach the unchecked return value
4. Trigger kernel panic via the resulting null dereference

How to detect it

Review kernel logs for oops or panic messages referencing rtw_xmit.c, r8188eu, or _rtw_init_xmit_priv around the time of unexpected reboots.

What your security team should do

• Prioritize kernel updates on systems exposing the r8188eu driver
• Audit wireless hardware inventory for Realtek USB devices using this staging driver
• Consider blacklisting the module on servers where wireless is unnecessary