CVE-2026-90403 in Linux
Summary
by MITRE • 09/17/2026
In the Linux kernel, the following vulnerability has been resolved:
wifi: rtlwifi: pci: fix error path in rtl_pci_probe()
In the last error path in rtl_pci_probe(), the cleanup functions are skipped due to a wrong goto label. Moreover, the successful call to rtl_init_rfkill(), ieee80211_register_hw(), rtl_debug_add_one() have to be reverted. Fix this issue by updating the labels and adding the relevant cleanup functions to the last error path.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/17/2026
The vulnerability identified in the Linux kernel within the Realtek WiFi PCI driver subsystem, specifically in the rtl_pci_probe function, represents a critical resource management flaw arising from improper control flow during device initialization. This issue is categorized under CWE-252, which describes unchecked return values that can lead to inconsistent system states, and more broadly aligns with CWE-754 regarding improper check for unusual or exceptional conditions. The core technical defect lies in the error handling logic of the probe routine, where a misconfigured goto label causes the execution flow to bypass essential cleanup routines when an initialization step fails late in the process. This structural oversight means that resources allocated by preceding successful function calls are not released, leading to potential resource leaks and state inconsistencies within the kernel memory space.
The operational impact of this flaw is significant for system stability and security posture. When rtl_init_rfkill, ieee80211_register_hw, or rtl_debug_add_one succeed but a subsequent step fails, the driver leaves these subsystems in an initialized yet unregistered or improperly terminated state. This can result in memory leaks that accumulate over time if the device is probed repeatedly during hot-plug events or system restarts. Furthermore, leaving hardware interfaces and debugfs entries active without proper teardown can expose internal kernel structures to unintended access patterns or cause race conditions when subsequent operations attempt to interact with partially initialized driver components. In severe cases, such state corruption could lead to kernel panics or undefined behavior if the subsystem assumes a clean slate upon re-initialization attempts.
From an attack surface perspective, this vulnerability falls under MITRE ATT&CK technique T1059, specifically related to command and script interpretation within system-level operations, although its primary impact is stability rather than direct exploitation for privilege escalation. However, resource exhaustion vulnerabilities can sometimes be leveraged in denial-of-service scenarios if an attacker can trigger repeated probe failures or device removals rapidly. The lack of proper cleanup means that kernel memory fragments are not returned to the pool efficiently, potentially contributing to long-term system degradation.
To mitigate this vulnerability, it is imperative to apply the upstream Linux kernel patch that corrects the goto label in rtl_pci_probe and ensures all relevant cleanup functions are invoked on error paths. System administrators should ensure their systems are updated with the latest stable kernel version containing this fix. For developers maintaining custom kernels or out-of-tree modules based on rtlwifi, it is crucial to audit probe routines for symmetric initialization and de-initialization logic. Every successful call to a subsystem registration function must have a corresponding teardown path executed in all error branches of the probe sequence. This includes ensuring that rfkill instances are properly released, hardware registers are unregistered from the mac80211 stack, and debugfs entries are removed before returning an error code to the PCI core. Adhering to strict resource management patterns prevents these types of logic errors and maintains kernel integrity during device lifecycle transitions.