PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-46187 Linux CVE debrief

A use-after-free (UAF) vulnerability exists in the Linux kernel's RSI (Redpine Signals) Wi-Fi driver due to a race condition in kthread lifetime management. The driver uses both self-exit (kthread_complete_and_exit) and external-stop (kthread_stop) mechanisms when terminating kernel threads. While kthread_stop() is typically called first without issue, a rare race where kthread_complete_and_exit() executes before kthread_stop() causes the latter to access an already-freed kthread object. The fix removes kthread_stop() and replaces it with a wait mechanism for the self-exit completion, eliminating the double-free race condition.

Vendor
Linux
Product
Unknown
CVSS
MEDIUM 4.7
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-28
Original CVE updated
2026-06-11
Advisory published
2026-05-28
Advisory updated
2026-06-11

Who should care

Organizations running Linux systems with Redpine Signals (RSI) Wi-Fi chipsets; embedded/IoT device manufacturers using RSI wireless modules; Linux distribution maintainers responsible for kernel security updates; security teams tracking kernel driver vulnerabilities affecting wireless networking stacks

Technical summary

The RSI (Redpine Signals) Wi-Fi driver in the Linux kernel contains a use-after-free vulnerability stemming from improper synchronization between two kthread termination paths. The driver historically allowed both self-exit via kthread_complete_and_exit() and external termination via kthread_stop(). When the self-exit path wins the race and completes first, the kthread object is freed; a subsequent kthread_stop() then dereferences the freed memory. The resolution removes the external kthread_stop() call entirely, instead waiting for the self-exit completion through proper synchronization primitives. This minimal change eliminates the race window without restructuring the driver's thread management logic.

Defensive priority

high

Recommended defensive actions

  • Apply kernel updates containing the referenced stable tree commits when available from your Linux distribution
  • Monitor vendor security advisories for RSI driver fixes in enterprise Linux distributions
  • If running custom kernels with RSI driver, cherry-pick the referenced commits from kernel.org stable trees
  • Review systems using Redpine Signals (RSI) Wi-Fi chipsets for exposure to this driver
  • Consider disabling RSI driver if not required until patches are applied

Evidence notes

CVE description confirms UAF in RSI Wi-Fi driver kthread handling. Five kernel.org stable tree commits provided as references indicate backports to multiple stable branches. No CVSS score assigned; NVD status 'Awaiting Analysis'.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-46187 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-46187

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-46187 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-46187

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/16d9f674c619838bdeae42abc0929c9c5477ea1f

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/4f4c9b13c485abd0a2d2c97f9db339d1dd8e147f

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/4f9a4ae8d2c198f01611ea376034c326ef43ab56

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/95fcb436586dc3c2983537d557ac05bbc6a027f3

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/db57a1aa54ff68669781976e4edb045e09e2b65b

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.