CVE-2024-27052

What it actually does

Use-after-free in the rtl8xxxu wireless driver caused by a pending c2hcmd_work item still executing after rtl8xxxu_stop() has begun tearing down driver structures.

Why it matters to the business

Systems using affected Realtek USB wifi adapters may experience kernel crashes, memory corruption, or local privilege escalation, leading to downtime and potential full host compromise.

How an attack unfolds

An attacker with the ability to stop the wireless interface or unload the module while a command-response work item is queued can trigger the freed object access, resulting in a crash or controlled memory corruption.

How to fix it

Update the Linux kernel to a version containing commit dddedfa3b29a63c2ca4336663806a6128b8545b4 or later; rebuild and reinstall any out-of-tree rtl8xxxu modules if used.

How to confirm the fix worked

Confirm the presence of cancel_work_sync() call for c2hcmd_work inside rtl8xxxu_stop() in the running kernel source or verify the git commit is included in the deployed kernel tree.

Typical attack path

1. Gain local access or sufficient privileges to control the wireless interface
2. Trigger repeated start/stop cycles or module unload while c2hcmd_work remains scheduled
3. Trigger the use-after-free during driver teardown
4. Leverage resulting memory corruption for privilege escalation or denial of service

How to detect it

Review kernel logs for oops/panic traces referencing rtl8xxxu_stop or c2hcmd_work around the time of interface down or module removal events; inspect audit logs for unusual module unload or interface state changes.

What your security team should do

• Prioritize kernel updates on all systems using rtl8xxxu-based Realtek USB adapters
• Monitor vendor kernel releases for backports of the referenced commit
• Restrict local user ability to unload modules or toggle interfaces on multi-user systems until patched