HIGH Introduced in 2.6.38
rtlwifi ProbePath Leak
CVE-2026-90403
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
KernelScan AI2.4LOW
01Description
In the Linux kernel, the following vulnerability has been resolved: wifi: rtlwifi: pci: fix error path in rtl_pci_probe() In the last error path in rtl_pci_probe(), the cleanup functions are skipped due to a wrong goto label. Moreover, the successful call to rtl_init_rfkill(), ieee80211_register_hw(), rtl_debug_add_one() have to be reverted. Fix this issue by updating the labels and adding the relevant cleanup functions to the last error path.
02KernelScan AI Analysis
Risk summary
A Realtek WiFi PCI driver fails to properly clean up already-initialized resources when device probe fails at the IRQ registration step, leaking registered wireless hardware, RF kill switch state, and debug entries. This requires a Realtek WiFi PCI device to be physically present in the system and its initialization to fail at a specific point. The impact is limited to resource leakage with potential for gradual system degradation.
Vulnerability analysis
When a Realtek WiFi PCI device is being initialized and the IRQ handler registration fails, the error cleanup path jumps to the wrong label and skips tearing down components that were already set up earlier in the probe, including the RF kill switch, the registered wireless hardware, and debug entries. This leaves those resources leaked. The fix adds a new error path label that properly unregisters and deinitializes those components before falling through to the remaining cleanup steps. This issue is reachable only on systems with a Realtek WiFi PCI chipset physically installed, and it triggers when that device's initialization fails at the IRQ allocation step — a condition that can arise from a faulty device or exhausted interrupt resources.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 5.10 | 2.6.38 | 5.10.270 | 2634998247d2 |
| 5.15 | 2.6.38 | 5.15.221 | cfd6824dd1d1 |
| 6.1 | 2.6.38 | 6.1.188 | 86e6187f8525 |
| 6.12 | 2.6.38 | 6.12.110 | b42fcfb097da |
| 6.18 | 2.6.38 | 6.18.52 | a89818977338 |
| 6.6 | 2.6.38 | 6.6.157 | aef178ffae54 |
| 7.2 | 2.6.38 | 7.2.6 | 1b68b6e529ce |
| mainline | 2.6.38 | 7.3 | 3c2999d13eeb |
| cip/5.10 | 2.6.38 | 5.10.271-cip78 | 2634998247d2 |
| cip/6.1 | 2.6.38 | 6.1.189-cip61 | 86e6187f8525 |
| cip/6.1-rt | 2.6.38 | 6.1.189-cip61-rt32 | 86e6187f8525 |
| cip/6.12 | 2.6.38 | 6.12.111-cip32 | b42fcfb097da |
04CIP Kernels
State of the newest release of each Civil Infrastructure Platform SLTS tree, from CIP's own fix records.
| CIP tree | State |
|---|---|
| cip/6.12 | Fixed in 6.12.111-cip32 |
| cip/6.1 | Fixed in 6.1.189-cip61 |
| cip/6.1-rt | Fixed in 6.1.189-cip61-rt32 |
| cip/5.10 | Fixed in 5.10.271-cip78 |
| cip/5.10-rt | Affected — no CIP fix yet (latest 5.10.268-cip77-rt34) |
| cip/4.19 | Affected — no CIP fix yet (latest 4.19.325-cip136) |
| cip/4.19-rt | Affected — no CIP fix yet (latest 4.19.325-cip136-rt50) |
| cip/4.4 | Affected — no CIP fix yet (latest 4.4.302-cip115) |
| cip/4.4-rt | Affected — no CIP fix yet (latest 4.4.302-cip115-rt63) |