CVE-2026-80939

What it actually does

On ARM64 Linux hosts using Realtek rtw89 PCI Wi-Fi, warm reboot runs device_shutdown() without the driver's .remove path. Because rtw89 PCI lacked a .shutdown callback, rfkill polling continued after the PCIe link was torn down. The next MMIO read (rtw89_pci_ops_read8) targeted a non-responding device, producing a fatal asynchronous SError and a kernel panic. The fix stops polling via a shutdown flag so no post-teardown MMIO occurs.

Why it matters to the business

Availability impact only: affected ARM64 systems can crash during restart instead of coming back cleanly, delaying patching, recovery, and remote administration. Exploit probability is very low (EPSS about 0.002 and flat over 30 days, not in KEV, no ransomware use, exploit maturity none). There is no confidentiality or integrity loss and no remote takeover. Operational risk is concentrated on ARM64 fleets that rely on rtw89 PCI wireless and warm reboot.

How an attack unfolds

This is a local denial-of-service reliability defect, not a remote compromise chain. Anyone or any process that can cause a warm reboot on a vulnerable ARM64 host with an rtw89 PCI adapter can induce a kernel panic: shutdown tears down PCIe while rfkill work still polls, an MMIO read faults, and the kernel panics with an asynchronous SError. No code execution, privilege escalation, or data theft follows. No named threat actors or in-the-wild campaigns are associated. Cold power-cycle typically recovers the host.

How to fix it

Install a Linux kernel that includes the rtw89 PCI .shutdown callback (rtw89_pci_shutdown setting RTW89_FLAG_SHUTDOWN so rtw89_ops_rfkill_poll returns without MMIO). Apply vendor/distro kernel updates that carry this change for all rtw89 PCI device IDs. Exact package versions were not published with this record; follow your kernel vendor advisory. If you cannot patch immediately, prefer cold power-cycle over warm reboot on affected ARM64 systems and unload rtw89_pci before planned restarts. Do not attempt a full .remove from shutdown; the upstream fix intentionally keeps the handler minimal.

How to confirm the fix worked

Confirm the running kernel changelog or driver wires .shutdown to rtw89_pci_shutdown and honors RTW89_FLAG_SHUTDOWN in rfkill poll. On a representative ARM64 test system with the adapter, perform a warm reboot and verify the host returns without an SError panic. Review post-reboot logs for absence of rfkill_poll / rtw89_pci_ops_read8 crash traces. Inventory ARM64 nodes that load rtw89_pci/rtw89_core to measure remaining exposure.

Typical attack path

1. Obtain local ability to trigger (or wait for) a warm reboot on an ARM64 Linux host with an rtw89 PCI Wi-Fi adapter
2. Reboot proceeds through device_shutdown() without rtw89 PCI .remove/.shutdown stopping rfkill work
3. PCIe link is torn down while rfkill polling remains queued
4. Poll path issues an MMIO read against the unresponsive device
5. ARM64 reports a fatal asynchronous SError and the kernel panics, denying service until reset

How to detect it

Look for crash evidence, not stealthy post-exploitation. Review kdump/vmcore, dmesg, journalctl, and serial/console logs around failed or hung warm reboots on ARM64. Match stacks through rfkill_poll, cfg80211/mac80211 rfkill, rtw89_ops_rfkill_poll, rtw89_core_rfkill_poll, and rtw89_pci_ops_read8, plus Asynchronous SError Interrupt. Correlate with reboot timestamps and rtw89_pci being loaded. No persistence, malware, or C2 artifacts are expected; absence of these panics only means the reboot crash path was not hit.

• Asynchronous SError Interrupt
• SError Interrupt on CPU
• code 0x00000000be000011
• Kernel panic - not syncing: Asynchronous SError Interrupt
• Workqueue: events_power_efficient rfkill_poll
• rtw89_pci_ops_read8
• rtw89_core_rfkill_poll
• rtw89_ops_rfkill_poll
• ieee80211_rfkill_poll
• cfg80211_rfkill_poll
• rfkill_poll [rfkill]

What your security team should do

• Patch ARM64 kernels that ship rtw89 PCI Wi-Fi as a planned availability fix, not an emergency internet-facing incident
• Identify hosts loading rtw89_pci and prefer cold reboot or module unload until patched
• Monitor kernel crash/kdump pipelines for rtw89 rfkill SError panics around reboot
• Do not prioritize as KEV/ransomware response; EPSS is low and exploit maturity is none
• Track distro kernel advisories until the shutdown-callback fix is confirmed installed