The Linux kernel rtl8xxxu WiFi driver had a use-after-free vulnerability caused by a race condition in the handling of RX URBs and worker scheduling. Specifically, rtl8xxxu_rx_urb_work() could run after rtl8xxxu_disconnect() freed the device private data (priv), leading to use-after-free. The root causes included scheduling work outside of the shutdown lock and not cancelling the rx_urb_wq worker before killing anchored URBs. The fix involved moving schedule_work() under the shutdown check, cancelling the rx_urb_wq worker synchronously before killing URBs, and ensuring no new work is scheduled after shutdown is set. This prevents the worker from running after the device memory is freed.

The vulnerability allows a use-after-free condition in the rtl8xxxu WiFi driver on Linux, which could lead to kernel memory corruption or crashes when the device is disconnected under active RX traffic. This may impact system stability and security by potentially enabling arbitrary code execution or denial of service, depending on exploitation. However, no known exploits are reported in the wild.

A fix for this vulnerability has been implemented in the Linux kernel source. Users should update to a kernel version that includes this patch. Since this is a kernel driver issue, applying the official kernel update from the vendor or distribution is the recommended remediation. No additional mitigation is required beyond applying the official fix.