CVE-2023-53452: 
Linux Kernel vulnerability analysis and mitigation

A race condition vulnerability was discovered in the Linux kernel's rtw89 WiFi driver (CVE-2023-53452). The issue occurs when netdev is registered but NAPI (New API) isn't initialized yet, and meanwhile user space starts the netdev that will enable NAPI. This vulnerability was disclosed on October 1, 2025 and affects the Linux kernel's WiFi subsystem (NVD).

The vulnerability manifests as a race condition between napiinit and napienable functions in the rtw89 WiFi driver. When triggered, it results in a kernel BUG_ON() at net/core/dev.c:6423 with an invalid opcode: 0000. The issue occurs in the driver initialization sequence where there's a timing window between network device registration and NAPI initialization (NVD).

When exploited, this vulnerability causes a kernel panic, leading to system instability and potential denial of service. The issue affects systems using the rtw89 WiFi driver in the Linux kernel (NVD).

The fix involves reordering the initialization sequence by moving the netdev registration to be the last step of PCI probe, following Jonas' suggestion. Additionally, the error handling of rtw89coreregister_hw() has been corrected (NVD).