CVE-2026-90403

What it actually does

Incorrect goto label in rtl_pci_probe() error path skips required cleanup after successful rtl_init_rfkill(), ieee80211_register_hw(), and rtl_debug_add_one() calls, leaving resources registered and enabling memory corruption or use-after-free conditions on probe failure.

Why it matters to the business

Local attackers on affected Linux systems with Realtek WiFi hardware may trigger kernel instability, crashes, or privilege escalation, increasing downtime and patch urgency despite low exploit maturity and stable low EPSS after 37 days.

How an attack unfolds

An attacker with local access loads or reloads the rtlwifi PCI driver to force rtl_pci_probe() through its final error path; the missing cleanup leaves partially initialized hardware and IEEE80211 structures, which can then be leveraged for memory corruption and code execution.

How to fix it

Apply the upstream fix that corrects the goto labels and adds the missing cleanup calls for rtl_init_rfkill(), ieee80211_register_hw(), and rtl_debug_add_one(); rebuild and deploy the updated kernel image across all affected systems.

How to confirm the fix worked

Inspect the rtl_pci_probe() function in the rtlwifi PCI driver source for correct error labels and presence of the three cleanup calls; verify the running kernel contains the patch by comparing against the commit that resolves the probe error path.

Typical attack path

1. Obtain local user access on target Linux system
2. Trigger rtl_pci_probe() via module load, device insertion, or error injection
3. Force execution into the final error path with the incorrect goto label
4. Exploit resulting unregistered state for memory corruption or UAF
5. Escalate to kernel code execution or denial of service

How to detect it

Review kernel ring buffer and dmesg output for rtlwifi probe error paths; correlate with module load events and failed ieee80211_register_hw attempts to identify systems that hit the buggy error path before patching.

• rtl_pci_probe.*error path
• rtl_init_rfkill.*ieee80211_register_hw.*rtl_debug_add_one

What your security team should do

• Prioritize kernel updates on systems exposing Realtek WiFi PCI devices within standard maintenance windows given low EPSS and no KEV listing
• Audit driver probe paths in custom kernels for similar goto-label errors
• Monitor kernel logs for rtlwifi probe failures as an early indicator of exposure