CVE-2023-54071: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-54071 is a vulnerability in the Linux kernel's rtw88 Wi-Fi driver (Realtek wireless) where the ieee80211_ops::sta_rc_update callback performs a voluntary context switch within an RCU (Read-Copy-Update) read-side critical section, triggering a kernel warning. The issue arises because ieee80211_chan_bw_change() holds the RCU read lock while calling drv_sta_rc_update(), which in turn performs blocking USB operations (via usb_control_msg), violating RCU atomicity requirements. It was published on December 24, 2025, and affects the Linux kernel. The EPSS score is approximately 0.017% (very low), indicating minimal exploitation probability (Feedly).

The root cause is a concurrency/locking violation (CWE-667: Improper Locking) in the rtw88 driver's sta_rc_update implementation. When a channel bandwidth change occurs, ieee80211_chan_bw_change() holds the RCU read lock and calls drv_sta_rc_update(), which eventually invokes rtw_fw_send_ra_info() → rtw_fw_send_h2c_command() → rtw_usb_read8() → usb_control_msg(), a blocking USB operation that triggers a context switch. This voluntary context switch within an RCU read-side critical section is illegal and produces a kernel WARNING at rcu_note_context_switch+0x571. The fix defers the rate update to a kernel work queue (work_struct) so that the blocking operation occurs outside the RCU critical section (Feedly).

Exploitation of this vulnerability can cause kernel warnings and potential system instability on Linux systems using Realtek Wi-Fi adapters driven by the rtw88 USB driver. The primary impact is availability — the RCU violation can lead to kernel warnings, undefined behavior in RCU-protected data structures, and in severe cases, kernel panics or system crashes. There is no known confidentiality or integrity impact, and the vulnerability is not exploitable for privilege escalation or remote code execution (Feedly).

The Linux kernel maintainers resolved this issue by refactoring the rtw88 driver to use a kernel work queue (work_struct) for rate updates, ensuring the blocking USB operation occurs outside the RCU read-side critical section. Patches are available in the stable kernel tree at the referenced git commits (commits 107677a8f435, bcafcb959a57, and dd3af22323e7). Users should update to a patched Linux kernel version that includes these fixes. No configuration-based workaround is known; upgrading the kernel is the recommended remediation (Feedly).