CVE-2026-23373: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23373 is a vulnerability in the Linux kernel's rsi WiFi driver where the rsi_mac80211_config function incorrectly defaults its return value to -EOPNOTSUPP instead of 0. This improper initialization triggers a WARN_ON in ieee80211_hw_conf_init during wireless hardware configuration, causing unexpected kernel warning conditions. The vulnerability affects Linux kernel versions 6.9.1 through 6.12.x (before 6.12.77), 6.13 through 6.18.x (before 6.18.17), 6.19.x (before 6.19.7), and 7.0 release candidates up to rc2. It was published on March 25, 2026, and carries a CVSS v3.1 base score of 5.5 (Medium) (Red Hat Advisory, Red Hat Bugzilla).

The root cause is classified as CWE-909 (Missing Initialization of Resource): the rsi_mac80211_config function in the rsi WiFi driver fails to properly initialize its return value, defaulting to -EOPNOTSUPP rather than the expected 0. This incorrect return value propagates to ieee80211_hw_conf_init, which triggers a WARN_ON assertion during wireless hardware configuration initialization. The attack vector is local, requiring low privileges, with no user interaction needed. The fix aligns the driver's default return behavior with other Linux WiFi drivers that correctly return 0 (Red Hat Bugzilla, Kernel Patch).

Exploitation of this vulnerability is limited to availability impact — specifically, disruption to wireless hardware configuration initialization on systems using the rsi WiFi driver. There is no confidentiality or integrity impact. Affected systems may experience degraded or failed wireless connectivity initialization, and the triggered WARN_ON can contribute to system instability on devices relying on the rsi driver for network access (Red Hat Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.018%, reflecting a very low probability of exploitation in the near term. Exploitation requires local access with low privileges, further limiting the practical attack surface (Red Hat Advisory).

• Logs: Presence of WARN_ON kernel warnings originating from ieee80211_hw_conf_init in system logs (e.g., /var/log/kern.log or dmesg output) on systems using the rsi WiFi driver.
• System Behavior: Unexpected failure or degradation of wireless interface initialization on devices using Redpine Signals (RSI) WiFi hardware, particularly during boot or driver reload.

Update the Linux kernel to a patched version: 6.12.77 or later (for versions 6.9.1–6.12.x), 6.18.17 or later (for versions 6.13–6.18.x), 6.19.7 or later (for versions 6.19.x), or 7.0-rc3 or later (for 7.0 release candidates). Patches are available via the upstream kernel stable tree. Organizations should identify systems using rsi driver hardware and prioritize kernel updates during scheduled maintenance windows. SUSE has also released security updates (SUSE-SU-2026:2217-1 and SUSE-SU-2026:2238-1) addressing this issue (Red Hat Advisory, Kernel Patch, SUSE Advisory).