Cloudanix VulnDB

CVE-2023-54071

None

CVSS

—

EPSS

0.3%

Published

Dec 24, 2025

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in certain Linux wireless drivers could cause system warnings or instability when the wireless network changes channels or speeds.

Exploitation
Other
Attacker needs
None
Complexity
Theoretical
Impact
Other
Component
OS kernel
Class
Race Condition
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

The flaw permits a voluntary context switch inside an RCU read-side critical section when ieee80211_ops::sta_rc_update invokes driver rate-update paths in the rtw88 wifi driver, violating RCU rules and producing warnings or kernel instability during channel or station context switches.

Why it matters to the business

Affected Linux systems using rtw88 hardware may experience repeated kernel warnings, wifi instability, or crashes during normal wireless operations, raising maintenance costs and downtime risk across large device fleets until kernels are updated.

How an attack unfolds

An attacker triggers ieee80211_chan_bw_change or similar station rate updates while the RCU read lock is held by mac80211 chswitch work, forcing the non-atomic driver path to schedule and hit the RCU context-switch assertion; no named threat actors or ransomware campaigns are associated with this issue.

How to fix it

Upgrade the Linux kernel to the commit 107677a8f43521e33e4a653e50fdf55ba622a4ce (or later stable releases that include it) in all distributions shipping the rtw88 driver; rebuild and reboot systems after applying the update.

How to confirm the fix worked

Verify the running kernel contains commit 107677a8f43521e33e4a653e50fdf55ba622a4ce via git log or package version; confirm absence of the RCU warning in dmesg when performing channel-width changes on rtw88 hardware.

Typical attack path

  1. Trigger wireless channel bandwidth change or station rate update via mac80211
  2. ieee80211_chswitch_work holds RCU read lock and calls drv_sta_rc_update
  3. rtw88 rate-update path performs blocking operations (usb control messages)
  4. RCU detects voluntary context switch and emits warning or undefined behavior

How to detect it

Search kernel logs (dmesg, journalctl) for the exact RCU warning string together with call traces containing rtw_usb_read, rtw_fw_send_h2c_command, ieee80211_chswitch_work, and rtw88 rate-update functions; correlate with usb control message activity on phy interfaces.

  • Voluntary context switch within RCU read-side critical section!
  • rtw_fw_send_h2c_command+0xa0/0x170
  • ieee80211_chswitch_work+0x95/0x170
  • rtw_usb_read8+0xf/0x10

What your security team should do

  • Prioritize kernel updates on all systems exposing rtw88 wifi hardware within the next maintenance window
  • Add the fixed commit hash to internal patch-tracking and SBOM tools
  • Monitor stable kernel changelogs for backports into distribution kernels
  • Test wifi stability under channel-switch workloads after patching

The record

In the Linux kernel, the following vulnerability has been resolved: wifi: rtw88: use work to update rate to avoid RCU warning The ieee80211_ops::sta_rc_update must be atomic, because ieee80211_chan_bw_change() holds rcu_read lock while calling drv_sta_rc_update(), so create a work to do original things. Voluntary context switch within RCU read-side critical section! WARNING: CPU: 0 PID: 4621 at kernel/rcu/tree_plugin.h:318 rcu_note_context_switch+0x571/0x5d0 CPU: 0 PID: 4621 Comm: kworker/u16:2 Tainted: G W OE Workqueue: phy3 ieee80211_chswitch_work [mac80211] RIP: 0010:rcu_note_context_switch+0x571/0x5d0 Call Trace: <TASK> __schedule+0xb0/0x1460 ? __mod_timer+0x116/0x360 schedule+0x5a/0xc0 schedule_timeout+0x87/0x150 ? trace_raw_output_tick_stop+0x60/0x60 wait_for_completion_timeout+0x7b/0x140 usb_start_wait_urb+0x82/0x160 [usbcore usb_control_msg+0xe3/0x140 [usbcore rtw_usb_read+0x88/0xe0 [rtw_usb rtw_usb_read8+0xf/0x10 [rtw_usb rtw_fw_send_h2c_command+0xa0/0x170 [rtw_core rtw_fw_send_ra_info+0xc9/0xf0 [rtw_core drv_sta_rc_update+0x7c/0x160 [mac80211 ieee80211_chan_bw_change+0xfb/0x110 [mac80211 ieee80211_change_chanctx+0x38/0x130 [mac80211 ieee80211_vif_use_reserved_switch+0x34e/0x900 [mac80211 ieee80211_link_use_reserved_context+0x88/0xe0 [mac80211 ieee80211_chswitch_work+0x95/0x170 [mac80211 process_one_work+0x201/0x410 worker_thread+0x4a/0x3b0 ? process_one_work+0x410/0x410 kthread+0xe1/0x110 ? kthread_complete_and_exit+0x20/0x20 ret_from_fork+0x1f/0x30 </TASK>

Affected packages

Ecosystem Package Introduced Fixed
Linux Kernel 5.19.0 6.1.30

Related vulnerabilities