Description

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: pcie: null RX pointers after free When iwl_pcie_tx_init() fails after RX init, nic init unwinds via iwl_pcie_rx_free(). The freed RX members stayed non-NULL on the live transport object, so later teardown or retry could touch stale RX state. Set rx_pool, global_table, rxq, and alloc_page to NULL after free to make repeated cleanup and retry paths safe.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.0",
  "pubDate": "2026-09-24T17:17:12.383Z",
  "pubdate": "2026-09-24T17:17:12.383Z",
  "executiveSummary": "This vulnerability involves a use-after-free condition within the Linux kernel's iwlwifi PCIe driver transport layer. The issue arises during the error handling path of the device initialization sequence.\nWhen iwl_pcie_tx_init() fails following a successful RX initialization, the driver invokes iwl_pcie_rx_free() to release memory. However, the function fails to nullify pointers to the freed RX memory structures, leaving stale pointers in the transport object.\nThis state inconsistency poses a significant risk as subsequent teardown or retry operations may attempt to access or operate upon these dangling pointers. The primary impact includes kernel memory corruption, system instability, or potential arbitrary code execution depending on the state of the heap at the time of the invalid access.\nThe vulnerability affects systems utilizing the iwlwifi driver and is triggered specifically during failure scenarios of the initialization process, requiring the driver to perform an unwinding sequence. No specific authentication or network access is required to trigger this, provided an attacker can influence the initialization failure of the device.",
  "technicalDetails": "The vulnerability resides in the error handling path of the iwlwifi PCIe transport initialization, specifically within the interaction between iwl_pcie_tx_init() and the RX resource management functions. When the driver attempts to initialize the TX component, failure conditions necessitate an immediate unwinding of previously allocated resources.\nThe root cause is a state synchronization failure in iwl_pcie_rx_free(). While this function correctly deallocates the memory associated with RX structures—specifically the rx_pool, global_table, rxq, and alloc_page members—it fails to update the corresponding pointers within the transport object to NULL. Consequently, the transport object retains references to memory regions that have already been returned to the kernel's allocator.\nIn the event of a subsequent recovery attempt or a forced device teardown, the driver may attempt to access or free these pointers again. Because the pointers are not nullified, the kernel operates under the assumption that these resources are still valid. This leads to a classic use-after-free scenario where the driver interacts with stale memory state.\nThe attack flow proceeds as follows: 1) The driver initiates the hardware reset or startup process; 2) The RX structures are initialized; 3) The TX initialization fails, triggering the unwinding path; 4) The driver calls iwl_pcie_rx_free(), which frees the memory but leaves the pointers populated; 5) A follow-up event (such as a device reset or driver unload) triggers a routine that attempts to clean up or re-initialize these pointers; 6) The kernel performs operations on stale, dangling pointers, leading to memory corruption or undefined behavior.\nExploitation involves triggering the failure path, which may be achievable through rapid device toggling or malicious physical device behavior if the hardware is controlled by the attacker. Since these operations occur within the kernel context, an attacker capable of triggering this flow can potentially influence kernel heap layout, leading to memory corruption primitives. The absence of NULL-pointer assignment is the critical flaw that permits the driver to bypass safety checks that would otherwise prevent the second access to the already-freed memory structures."
}