CVE-2026-23073: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23073 is a memory corruption vulnerability in the Linux kernel's RSI (RSI911x) Wi-Fi driver, caused by the driver failing to set the VIF (Virtual Interface) driver data size when allocating struct ieee80211_vif. This omission means no trailing memory is reserved for the driver's private data structure (struct vif_priv), leading to out-of-bounds writes when the driver accesses vif->drv_priv. The vulnerability affects Linux kernel versions from 3.15 up to (but not including) 5.10.249, 5.15.199, 6.1.162, 6.6.122, 6.12.68, and 6.18.8, as well as release candidates for 6.19. It was published on February 4, 2026, with patches added on March 18, 2026, and carries a CVSS v3.1 base score of 7.8 (High) (Feedly, kernel patches).

The root cause is classified as CWE-787 (Out-of-bounds Write). The RSI911x Wi-Fi driver (drivers/net/wireless/rsi/) uses vif->drv_priv to store a struct vif_priv object, but never sets hw->vif_data_size to sizeof(struct vif_priv) — a required step so the mac80211 subsystem allocates sufficient trailing memory when creating a struct ieee80211_vif. As a result, writes to vif_info->vap_id in rsi_mac80211_add_interface() corrupt adjacent kernel memory, specifically overwriting the struct list_head new_flows member of a struct fq_tin object. This corruption causes a kernel crash when fq_tin_reset() dereferences the bogus list pointer. The vulnerability is locally exploitable (attack vector: local) with low privileges required and no user interaction needed. The fix is straightforward: setting hw->vif_data_size = sizeof(struct vif_priv) in the driver initialization path (Feedly, kernel patches).

Successful exploitation results in kernel memory corruption that can cause a system crash (denial of service) and potentially allows a local attacker with low privileges to escalate privileges or corrupt sensitive kernel data structures, impacting confidentiality, integrity, and availability. The crash is reliably triggered by bringing up and then down a wireless interface backed by the RSI911x chipset (e.g., ip link set wlan0 up followed by ip link set wlan0 down). The scope is limited to systems using RSI911x-based Wi-Fi hardware, but on affected hardware the impact is severe — a full kernel panic is observed in practice (Feedly).

1. Identify target: Locate a Linux system running a vulnerable kernel version (3.15–6.18.7 or 6.19-rc1 through rc6) with an RSI911x-based Wi-Fi adapter (e.g., Redpine RS9113 or similar).
2. Gain local access: Obtain a local shell with at least low-privilege user access on the target system.
3. Trigger interface bring-up: Execute ip link set wlan0 up (or equivalent) to invoke rsi_mac80211_add_interface(), which writes vif_info->vap_id into unallocated memory beyond struct ieee80211_vif, corrupting the adjacent struct fq_tin member new_flows.
4. Trigger interface bring-down: Execute ip link set wlan0 down (or wait briefly), which causes fq_tin_reset() to dereference the corrupted list_head, resulting in a kernel panic or potential controlled memory corruption for privilege escalation.

• Logs: Kernel oops or panic messages in /var/log/kern.log or dmesg referencing fq_tin_reset(), list_first_entry(), or invalid pointer dereferences in the RSI Wi-Fi driver stack.
• Process/System: Unexpected system reboots or kernel panics on systems with RSI911x Wi-Fi hardware, particularly correlated with wireless interface state changes.
• Kernel Messages: dmesg output showing BUG: unable to handle kernel paging request or general protection fault with stack traces involving rsi_mac80211_add_interface, fq_tin_reset, or ieee80211_vif allocation paths.

The Linux kernel maintainers have released patches across all affected stable branches. Users should update to kernel versions 5.10.249, 5.15.199, 6.1.162, 6.6.122, 6.12.68, 6.18.8, or later (including 6.19 stable once released). Patches are available in the stable kernel tree (kernel patch 1, kernel patch 2). Distribution-specific updates have been issued by Ubuntu (USN-8162-1, USN-8180-1 through USN-8180-6, USN-8186-1, USN-8188-1, USN-8275-1, USN-8278-1/2, USN-8289-1/2, USN-8296-1/2, USN-8297-1, USN-8393-1), SUSE (SUSE-2026-0962-1), and Oracle Linux (ELSA-2026-50160, ELSA-2026-50232). As a temporary workaround on systems where the RSI911x driver is not needed, blacklisting the rsi_91x kernel module (echo 'blacklist rsi_91x' >> /etc/modprobe.d/blacklist.conf) will prevent the vulnerable code path from executing (Ubuntu USN-8162-1, SUSE advisory).