CVE-2024-46760

What it actually does

Race condition during USB probe allows RX work to start before rtw_dev and ieee80211 hardware structures are fully initialized, resulting in NULL pointer dereference inside rtw_rx_fill_rx_status.

Why it matters to the business

Kernel crashes or device instability on systems using affected Realtek USB WiFi adapters can interrupt operations and require reboots or driver reloads.

How an attack unfolds

During normal USB device enumeration the driver submits URBs before register_hw completes; incoming RX completions then dereference uninitialized fields, producing a panic.

How to fix it

Update the Linux kernel to a version containing commit c83d464b82a8ad62ec9077637f75d73fe955635a; rebuild and reboot with the patched driver.

How to confirm the fix worked

Confirm the presence of the fix commit in the running kernel source and verify that no NULL dereference stack traces referencing rtw_rx_fill_rx_status appear during device probe.

Typical attack path

1. Connect affected Realtek USB WiFi adapter
2. Driver probe begins asynchronous RX resubmission
3. USB completion handler queues work before ieee80211_register_hw finishes
4. rtw_rx_fill_rx_status dereferences NULL chandef or hw fields

How to detect it

Search kernel logs and dmesg for rtw_rx_fill_rx_status, rtw8821c_query_rx_desc, hw->conf.chandef.chan NULL, and band wrong packet dropped messages around USB device insertion times.

• rtw_rx_fill_rx_status
• hw->conf.chandef.chan NULL
• band wrong, packet dropped
• rtw_usb_rx_handler
• rtw_usb_read_port_complete

What your security team should do

• Apply the referenced kernel commit or distribution update immediately on affected systems
• Test USB WiFi adapters after patching to ensure stable probe behavior
• Monitor kernel logs for the described oops pattern until remediation is complete