CVE-2026-80939

What the bug is

Since the hardware rfkill polling was introduced, arm64 platforms can panic with an asynchronous SError during warm reboot: SError Interrupt on CPU8, code 0x00000000be000011 -- SError Workqueue: events_power_efficient rfkill_poll [rfkill] rtw89_pci_ops_read8+0x94/0x160 [rtw89_pci] rtw89_core_rfkill_poll+0x50/0x1e0 [rtw89_core] rtw89_ops_rfkill_poll+0x40/0x68 [rtw89_core] ieee80211_rfkill_poll+0x3c/0x70 [mac80211] cfg80211_rfkill_poll+0x40/0x2a0 [cfg80211] rfkill_poll+0x30/0x88 [rfkill] Kernel panic - not syncing: Asynchronous SError Interrupt On the reboot path the kernel only runs device_shutdown(), which calls each driver's .shutdown callback; .remove is not invoked. The rtw89 PCI driver had no .shutdown callback, so nothing stopped the rfkill polling work while the platform was tearing the PCIe link down. Once the link is gone, the next MMIO read from the poll handler targets a non-responding device and is reported as a fatal asynchronous SError on arm64. Add rtw89_pci_shutdown(), wired to all rtw89 PCI device drivers, which sets a new RTW89_FLAG_SHUTDOWN flag (mirroring the USB RTW89_FLAG_UNPLUGGED pattern). When the flag is set, rtw89_ops_rfkill_poll() returns early, so no MMIO read is issued to the chip after shutdown begins and the SError no longer occurs. This does not call the full .remove path from .shutdown, to keep the shutdown handler minimal and avoid running the non-idempotent teardown twice.

Where it lives

The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.

drivers/net/wireless/realtek/rtw89/core.h
drivers/net/wireless/realtek/rtw89/mac80211.c
drivers/net/wireless/realtek/rtw89/pci.c
drivers/net/wireless/realtek/rtw89/pci.h
drivers/net/wireless/realtek/rtw89/rtw8851be.c
drivers/net/wireless/realtek/rtw89/rtw8852ae.c
drivers/net/wireless/realtek/rtw89/rtw8852be.c
drivers/net/wireless/realtek/rtw89/rtw8852bte.c
drivers/net/wireless/realtek/rtw89/rtw8852ce.c
drivers/net/wireless/realtek/rtw89/rtw8922ae.c
drivers/net/wireless/realtek/rtw89/rtw8922de.c

What this is

REALTEK WIRELESS DRIVER (rtw89)MAINTAINERS section matched on drivers/net/wireless/realtek/rtw89/ · linux-wireless@vger.kernel.org · Maintained

Kernel module

rtw89_core

Check it on the machine

grep -wE 'CONFIG_RTW89|CONFIG_RTW89_CORE|CONFIG_WLAN|CONFIG_WLAN_VENDOR_REALTEK' /boot/config-$(uname -r)

Reads the booted kernel's own configuration, on the machine and nowhere else. =y is built in, =m is a module, and an is not set line means the code is not there.

lsmod | grep -w rtw89_core

Prints a line if that module is loaded right now, and nothing if it is not. One that is not loaded can still be loaded later by anything that needs it.

Show whether Debian builds this, per release

Debian builds this, but not on every flavour. At least one release below builds the code on some of its kernel flavours and not on others, so the answer depends on the architecture and flavour installed.

• bookwormMnot built on amd64/cloud-amd64, arm64/cloud-arm64
• trixieMnot built on amd64/cloud-amd64, arm64/cloud-arm64, armel/rpi, s390x/s390x
• forky, sidMnot built on amd64/cloud-amd64, arm64/cloud-arm64, s390x/s390x

M

a module where it is built at all; some flavours do not build it

Build switches

CONFIG_RTW89, CONFIG_RTW89_CORE, CONFIG_WLAN, CONFIG_WLAN_VENDOR_REALTEK

Reads as

all on means the file is compiled; any one off means it is not.

From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS kbuild Makefiles Debian linux-config packages

Signals

Published

2026-09-11 (37 days ago)source

CVSS

no vector published, unrated

Attack vector

not published

EPSS

0.21%, higher than 10.3% of all CVEssource

CISA KEV

not listedthe KEV catalogue

Debian urgency

unimportantsource

Subsystem

drivers/net

Upstream fixes

The versions the CNA records as introducing and fixing this, and the commit for each. source

Introduced	Fixed in	Commit
6.12	6.12.112	dfe2b5b20569
6.12	6.18.52	9693980cd7d2
6.12	7.2.4	c1f214dd1351
6.12	7.3	667c12782aaf

Debian advisories