CVE-2026-72005

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

wifi: rt2x00: avoid full teardown before work setup in probe

rt2x00lib_probe_dev() uses the full rt2x00lib_remove_dev() teardown for

all probe failures. However, drv_data allocation and workqueue allocation

can fail before intf_work, autowakeup_work and sleep_work have been

initialized.

Do not enter the full remove path until the probe has reached the point

where those work items are set up. Return directly for drv_data allocation

failure, and use a small early cleanup path for workqueue allocation

failure.

This issue was found by our static analysis tool and then confirmed by

manual review of rt2x00lib_probe_dev() and rt2x00lib_remove_dev(). The

early probe exits should not call a common teardown path that assumes the

later work setup has already completed.

A QEMU PoC forced alloc_ordered_workqueue() to fail before the work

initializers are reached. The resulting fail path entered

rt2x00lib_remove_dev(), and DEBU

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References