CVE-2026-72005 Linux CVE debrief

Who should care

Linux kernel developers, Linux distribution maintainers, and users of Linux-based systems that utilize the rt2x00 wifi driver should be aware of this vulnerability and take necessary actions to secure their systems. The vulnerability affects the Linux kernel, specifically the rt2x00 wifi driver, and a local attacker could exploit this vulnerability to cause a denial of service or potentially execute arbitrary code. Linux kernel developers should review and update Linux kernel configurations to ensure rt2x00 wifi driver is properly secured. Linux distribution maintainers should apply the official patch or update to a fixed version of the Linux kernel. Users of Linux-based systems should monitor Linux kernel logs for suspicious activity related to rt2x00 wifi driver. Security teams should review compensating controls for exposed systems while remediation is scheduled and verified. Vulnerability management teams should track exceptions, retest remediated assets, and close the item only after evidence is documented. Asset inventory teams should confirm whether affected product deployments exist in managed environments and assign an owner for follow-up. Monitoring and detection teams should check relevant monitoring, detection, and logs for exposed assets that need extra review. IT teams should plan vendor-supported updates or mitigations through normal change control where exposure is confirmed. Penetration testing teams should review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance. Compliance teams should ensure that the necessary steps are taken to comply with regulatory requirements. Incident response teams should be prepared to respond to potential exploits of this vulnerability. Security awareness teams should educate users about the risks associated with this vulnerability and the importance of applying patches or updates. Business continuity teams should ensure that business continuity plans are in place in case of an exploit. Risk management teams should assess the risk associated with this vulnerability and prioritize remediation efforts accordingly. Compliance and audit teams should ensure that the rem

Technical summary

The rt2x00lib_probe_dev() function in the Linux kernel's rt2x00 wifi driver has a vulnerability. When probe failures occur, the function uses the full rt2x00lib_remove_dev() teardown. However, drv_data allocation and workqueue allocation can fail before intf_work, autowakeup_work, and sleep_work have been initialized. This can cause a denial of service or potentially allow a local attacker to execute arbitrary code.

Defensive priority

This vulnerability affects the Linux kernel, specifically the rt2x00 wifi driver. A local attacker could exploit this vulnerability to cause a denial of service or potentially execute arbitrary code.

Recommended defensive actions

• Apply the official patch or update to a fixed version of the Linux kernel
• Review and update Linux kernel configurations to ensure rt2x00 wifi driver is properly secured
• Monitor Linux kernel logs for suspicious activity related to rt2x00 wifi driver
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Review compensating controls for exposed systems while remediation is scheduled and verified.

Evidence notes

The CVE-2026-72005 vulnerability was found in the Linux kernel's rt2x00 wifi driver. The vulnerability occurs when the rt2x00lib_probe_dev() function uses the full rt2x00lib_remove_dev() teardown for all probe failures. However, drv_data allocation and workqueue allocation can fail before intf_work, autowakeup_work, and sleep_work have been initialized. A QEMU PoC was used to force alloc_ordered_workqueue() to fail before the work initializers are reached.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.