CVE-2023-53452
NoneCVSS
—
EPSS
0.1%
Published
Oct 1, 2025
CISA due date
—
Cloudanix analysis
A timing problem in certain wireless network drivers could make the computer crash when the WiFi connection starts.
- Exploitation
- Local Privilege
- Attacker needs
- Local User
- Complexity
- Moderate
- Impact
- Denial Of Service
- Component
- OS kernel
- Class
- Race Condition
- Remediation
- Upgrade
- Effort
- Medium
- Patch risk
- Low
What it actually does
Race condition between netdev registration and NAPI initialization allows napi_enable to be called before napi_init completes, triggering BUG_ON in net/core/dev.c.
Why it matters to the business
Unexpected kernel crashes on systems using affected rtw89 WiFi hardware can interrupt operations, reduce device availability, and require reboots, with higher urgency on widely deployed Linux distributions.
How an attack unfolds
An attacker with local access triggers netdev bring-up (for example via wpa_supplicant or iwd) before the PCI probe finishes NAPI setup; the resulting race hits the assertion in napi_enable and crashes the kernel. No widespread remote exploitation or named threat actor campaigns are associated with this flaw.
How to fix it
Upgrade to a fixed kernel containing commit 39712c8aeb79691bcec8bd6ff658cde1651e0803 or later; on Debian 11 use 1.3.2-4+deb11u1, on Debian 12/13/14 use 1.3.2-5 or newer packages that reorder register_netdev after NAPI initialization.
How to confirm the fix worked
Verify kernel version contains the referenced commit, confirm rtw89_pci_ops_start no longer calls napi_enable before napi_init, and test interface bring-up under concurrent probe conditions.
Typical attack path
- Obtain local code execution or user privileges on target system
- Ensure rtw89_pci driver is loaded and netdev registration begins
- Start the interface before rtw89_core_register_hw completes NAPI init
- Trigger the assertion in napi_enable leading to kernel panic
How to detect it
Search kernel logs for the BUG_ON signature at net/core/dev.c:6423 combined with rtw89_pci_ops_start and ieee80211_do_open call traces; inspect crash dumps for PID associated with network management daemons.
What your security team should do
- Apply the fixed kernel packages immediately on all affected Debian and upstream distributions
- Prioritize systems with rtw89 WiFi hardware due to direct hardware exposure
- Monitor EPSS trend and re-evaluate if exploit maturity increases
- Test updated kernels in staging environments before broad rollout
The record
In the Linux kernel, the following vulnerability has been resolved: wifi: rtw89: fix potential race condition between napi_init and napi_enable A race condition can happen if netdev is registered, but NAPI isn't initialized yet, and meanwhile user space starts the netdev that will enable NAPI. Then, it hits BUG_ON(): kernel BUG at net/core/dev.c:6423! invalid opcode: 0000 [#1] PREEMPT SMP NOPTI CPU: 0 PID: 417 Comm: iwd Not tainted 6.2.7-slab-dirty #3 eb0f5a8a9d91 Hardware name: LENOVO 21DL/LNVNB161216, BIOS JPCN20WW(V1.06) 09/20/2022 RIP: 0010:napi_enable+0x3f/0x50 Code: 48 89 c2 48 83 e2 f6 f6 81 89 08 00 00 02 74 0d 48 83 ... RSP: 0018:ffffada1414f3548 EFLAGS: 00010246 RAX: 0000000000000000 RBX: ffffa01425802080 RCX: 0000000000000000 RDX: 00000000000002ff RSI: ffffada14e50c614 RDI: ffffa01425808dc0 RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000001 R11: 0000000000000100 R12: ffffa01425808f58 R13: 0000000000000000 R14: ffffa01423498940 R15: 0000000000000001 FS: 00007f5577c0a740(0000) GS:ffffa0169fc00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f5577a19972 CR3: 0000000125a7a000 CR4: 0000000000750ef0 PKRU: 55555554 Call Trace: <TASK> rtw89_pci_ops_start+0x1c/0x70 [rtw89_pci 6cbc75429515c181cbc386478d5cfb32ffc5a0f8] rtw89_core_start+0xbe/0x160 [rtw89_core fe07ecb874820b6d778370d4acb6ef8a37847f22] rtw89_ops_start+0x26/0x40 [rtw89_core fe07ecb874820b6d778370d4acb6ef8a37847f22] drv_start+0x42/0x100 [mac80211 c07fa22af8c3cf3f7d7ab3884ca990784d72e2d2] ieee80211_do_open+0x311/0x7d0 [mac80211 c07fa22af8c3cf3f7d7ab3884ca990784d72e2d2] ieee80211_open+0x6a/0x90 [mac80211 c07fa22af8c3cf3f7d7ab3884ca990784d72e2d2] __dev_open+0xe0/0x180 __dev_change_flags+0x1da/0x250 dev_change_flags+0x26/0x70 do_setlink+0x37c/0x12c0 ? ep_poll_callback+0x246/0x290 ? __nla_validate_parse+0x61/0xd00 ? __wake_up_common_lock+0x8f/0xd0 To fix this, follow Jonas' suggestion to switch the order of these functions and move register netdev to be the last step of PCI probe. Also, correct the error handling of rtw89_core_register_hw().
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Linux | Kernel | 5.16.0 | 6.1.28 |
| SUSE:Linux Enterprise High Availability Extension 15 SP4 | kernel-default | 0 | 5.14.21-150400.24.179.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS | kernel-64kb | 0 | 5.14.21-150400.24.179.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS | kernel-default | 0 | 5.14.21-150400.24.179.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS | kernel-default-base | 0 | 5.14.21-150400.24.179.1.150400.24.92.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS | kernel-docs | 0 | 5.14.21-150400.24.179.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS | kernel-obs-build | 0 | 5.14.21-150400.24.179.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS | kernel-source | 0 | 5.14.21-150400.24.179.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS | kernel-syms | 0 | 5.14.21-150400.24.179.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS | kernel-64kb | 0 | 5.14.21-150400.24.179.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS | kernel-default | 0 | 5.14.21-150400.24.179.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS | kernel-default-base | 0 | 5.14.21-150400.24.179.1.150400.24.92.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS | kernel-docs | 0 | 5.14.21-150400.24.179.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS | kernel-obs-build | 0 | 5.14.21-150400.24.179.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS | kernel-source | 0 | 5.14.21-150400.24.179.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS | kernel-syms | 0 | 5.14.21-150400.24.179.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS | kernel-64kb | 0 | 5.14.21-150500.55.124.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS | kernel-default | 0 | 5.14.21-150500.55.124.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS | kernel-default-base | 0 | 5.14.21-150500.55.124.1.150500.6.59.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS | kernel-docs | 0 | 5.14.21-150500.55.124.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS | kernel-obs-build | 0 | 5.14.21-150500.55.124.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS | kernel-source | 0 | 5.14.21-150500.55.124.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS | kernel-syms | 0 | 5.14.21-150500.55.124.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS | kernel-64kb | 0 | 5.14.21-150500.55.124.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS | kernel-default | 0 | 5.14.21-150500.55.124.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS | kernel-default-base | 0 | 5.14.21-150500.55.124.1.150500.6.59.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS | kernel-docs | 0 | 5.14.21-150500.55.124.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS | kernel-obs-build | 0 | 5.14.21-150500.55.124.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS | kernel-source | 0 | 5.14.21-150500.55.124.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS | kernel-syms | 0 | 5.14.21-150500.55.124.1 |
| SUSE:Linux Enterprise Live Patching 15 SP4 | kernel-default | 0 | 5.14.21-150400.24.179.1 |
| SUSE:Linux Enterprise Live Patching 15 SP4 | kernel-livepatch-SLE15-SP4_Update_45 | 0 | 1-150400.9.3.1 |
| SUSE:Linux Enterprise Live Patching 15 SP5 | kernel-default | 0 | 5.14.21-150500.55.124.1 |
| SUSE:Linux Enterprise Live Patching 15 SP5 | kernel-livepatch-SLE15-SP5_Update_31 | 0 | 1-150500.11.3.1 |
| SUSE:Linux Enterprise Micro 5.3 | kernel-default | 0 | 5.14.21-150400.24.179.1 |
| SUSE:Linux Enterprise Micro 5.3 | kernel-default-base | 0 | 5.14.21-150400.24.179.1.150400.24.92.1 |
| SUSE:Linux Enterprise Micro 5.3 | kernel-rt | 0 | 5.14.21-150400.15.133.1 |
| SUSE:Linux Enterprise Micro 5.3 | kernel-source-rt | 0 | 5.14.21-150400.15.133.1 |
| SUSE:Linux Enterprise Micro 5.4 | kernel-default | 0 | 5.14.21-150400.24.179.1 |
| SUSE:Linux Enterprise Micro 5.4 | kernel-default-base | 0 | 5.14.21-150400.24.179.1.150400.24.92.1 |
| SUSE:Linux Enterprise Micro 5.4 | kernel-rt | 0 | 5.14.21-150400.15.133.1 |
| SUSE:Linux Enterprise Micro 5.4 | kernel-source-rt | 0 | 5.14.21-150400.15.133.1 |
| SUSE:Linux Enterprise Micro 5.5 | kernel-default | 0 | 5.14.21-150500.55.124.1 |
| SUSE:Linux Enterprise Micro 5.5 | kernel-default-base | 0 | 5.14.21-150500.55.124.1.150500.6.59.1 |
| SUSE:Linux Enterprise Micro 5.5 | kernel-rt | 0 | 5.14.21-150500.13.109.1 |
| SUSE:Linux Enterprise Micro 5.5 | kernel-source | 0 | 5.14.21-150500.55.124.1 |
| SUSE:Linux Enterprise Micro 5.5 | kernel-source-rt | 0 | 5.14.21-150500.13.109.1 |
| SUSE:Linux Enterprise Server 15 SP4-LTSS | kernel-64kb | 0 | 5.14.21-150400.24.179.1 |
| SUSE:Linux Enterprise Server 15 SP4-LTSS | kernel-default | 0 | 5.14.21-150400.24.179.1 |
| SUSE:Linux Enterprise Server 15 SP4-LTSS | kernel-default-base | 0 | 5.14.21-150400.24.179.1.150400.24.92.1 |
| SUSE:Linux Enterprise Server 15 SP4-LTSS | kernel-docs | 0 | 5.14.21-150400.24.179.1 |
| SUSE:Linux Enterprise Server 15 SP4-LTSS | kernel-obs-build | 0 | 5.14.21-150400.24.179.1 |
| SUSE:Linux Enterprise Server 15 SP4-LTSS | kernel-source | 0 | 5.14.21-150400.24.179.1 |
| SUSE:Linux Enterprise Server 15 SP4-LTSS | kernel-syms | 0 | 5.14.21-150400.24.179.1 |
| SUSE:Linux Enterprise Server 15 SP4-LTSS | kernel-zfcpdump | 0 | 5.14.21-150400.24.179.1 |
| SUSE:Linux Enterprise Server 15 SP5-LTSS | kernel-64kb | 0 | 5.14.21-150500.55.124.1 |
| SUSE:Linux Enterprise Server 15 SP5-LTSS | kernel-default | 0 | 5.14.21-150500.55.124.1 |
| SUSE:Linux Enterprise Server 15 SP5-LTSS | kernel-default-base | 0 | 5.14.21-150500.55.124.1.150500.6.59.1 |
| SUSE:Linux Enterprise Server 15 SP5-LTSS | kernel-docs | 0 | 5.14.21-150500.55.124.1 |
| SUSE:Linux Enterprise Server 15 SP5-LTSS | kernel-obs-build | 0 | 5.14.21-150500.55.124.1 |
| SUSE:Linux Enterprise Server 15 SP5-LTSS | kernel-source | 0 | 5.14.21-150500.55.124.1 |
| SUSE:Linux Enterprise Server 15 SP5-LTSS | kernel-syms | 0 | 5.14.21-150500.55.124.1 |
| SUSE:Linux Enterprise Server 15 SP5-LTSS | kernel-zfcpdump | 0 | 5.14.21-150500.55.124.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP4 | kernel-default | 0 | 5.14.21-150400.24.179.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP4 | kernel-default-base | 0 | 5.14.21-150400.24.179.1.150400.24.92.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP4 | kernel-docs | 0 | 5.14.21-150400.24.179.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP4 | kernel-obs-build | 0 | 5.14.21-150400.24.179.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP4 | kernel-source | 0 | 5.14.21-150400.24.179.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP4 | kernel-syms | 0 | 5.14.21-150400.24.179.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP5 | kernel-default | 0 | 5.14.21-150500.55.124.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP5 | kernel-default-base | 0 | 5.14.21-150500.55.124.1.150500.6.59.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP5 | kernel-docs | 0 | 5.14.21-150500.55.124.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP5 | kernel-obs-build | 0 | 5.14.21-150500.55.124.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP5 | kernel-source | 0 | 5.14.21-150500.55.124.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP5 | kernel-syms | 0 | 5.14.21-150500.55.124.1 |
| SUSE:Manager Proxy LTS 4.3 | kernel-default | 0 | 5.14.21-150400.24.179.1 |
| SUSE:Manager Proxy LTS 4.3 | kernel-default-base | 0 | 5.14.21-150400.24.179.1.150400.24.92.1 |
| SUSE:Manager Proxy LTS 4.3 | kernel-source | 0 | 5.14.21-150400.24.179.1 |
| SUSE:Manager Proxy LTS 4.3 | kernel-syms | 0 | 5.14.21-150400.24.179.1 |
| SUSE:Manager Server LTS 4.3 | kernel-default | 0 | 5.14.21-150400.24.179.1 |
| SUSE:Manager Server LTS 4.3 | kernel-default-base | 0 | 5.14.21-150400.24.179.1.150400.24.92.1 |
| SUSE:Manager Server LTS 4.3 | kernel-source | 0 | 5.14.21-150400.24.179.1 |
| SUSE:Manager Server LTS 4.3 | kernel-syms | 0 | 5.14.21-150400.24.179.1 |
| SUSE:Manager Server LTS 4.3 | kernel-zfcpdump | 0 | 5.14.21-150400.24.179.1 |
Related vulnerabilities
- CVE-2026-23226 In the Linux kernel, the following vulnerability has been resolved: ksmbd: add chann_lock… Also affects Kernel
- CVE-2026-23225 In the Linux kernel, the following vulnerability has been resolved: sched/mmcid: Don't… Also affects Kernel
- CVE-2026-23230 In the Linux kernel, the following vulnerability has been resolved: smb: client: split… Also affects Kernel
- CVE-2026-23224 In the Linux kernel, the following vulnerability has been resolved: erofs: fix UAF issue… Also affects Kernel
- CVE-2026-23227 In the Linux kernel, the following vulnerability has been resolved: drm/exynos: vidi: use… Also affects Kernel
- CVE-2026-23223 In the Linux kernel, the following vulnerability has been resolved: xfs: fix UAF in… Also affects Kernel
- CVE-2026-23228 In the Linux kernel, the following vulnerability has been resolved: smb: server: fix leak… Also affects Kernel
- CVE-2026-23229 In the Linux kernel, the following vulnerability has been resolved: crypto: virtio - Add… Also affects Kernel