{"id":"CVE-2023-54071","title":"wifi: rtw88: use work to update rate to avoid RCU warning","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: rtw88: use work to update rate to avoid RCU warning\n\nThe ieee80211_ops::sta_rc_update must be atomic, because\nieee80211_chan_bw_change() holds rcu_read lock while…","severity":"high","cvss":8.8,"cvssVector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvssSource":"cna","vendor":"Linux","product":"Linux","affected":["Linux >= c1edc86472fc3a5aa3b5c5c53c4e20f6a24992a6 < 107677a8f43521e33e4a653e50fdf55ba622a4ce","Linux >= c1edc86472fc3a5aa3b5c5c53c4e20f6a24992a6 < dd3af22323e79a2ffabed366db20aab83716fe6f","Linux >= c1edc86472fc3a5aa3b5c5c53c4e20f6a24992a6 < bcafcb959a57a6890e900199690c5fc47da1a304","Linux 5.19"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-10-15T21:38:13.834973Z"},"published":"2025-12-24","updated":"2026-10-15","sourceUpdated":"2026-10-15T21:41:38.954Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2023-54071","references":[{"url":"https://git.kernel.org/stable/c/107677a8f43521e33e4a653e50fdf55ba622a4ce"},{"url":"https://git.kernel.org/stable/c/dd3af22323e79a2ffabed366db20aab83716fe6f"},{"url":"https://git.kernel.org/stable/c/bcafcb959a57a6890e900199690c5fc47da1a304"}],"tags":["cve.org"],"epss":0.00273,"epssPercentile":0.18346,"ingestedAt":"2026-10-15T22:48:25.427Z","slug":"CVE-2023-54071","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nwifi: rtw88: use work to update rate to avoid RCU warning\n\nThe ieee80211_ops::sta_rc_update must be atomic, because\nieee80211_chan_bw_change() holds rcu_read lock while calling\ndrv_sta_rc_update(), so create a work to do original things.\n\n Voluntary context switch within RCU read-side critical section!\n WARNING: CPU: 0 PID: 4621 at kernel/rcu/tree_plugin.h:318\n rcu_note_context_switch+0x571/0x5d0\n CPU: 0 PID: 4621 Comm: kworker/u16:2 Tainted: G        W  OE\n Workqueue: phy3 ieee80211_chswitch_work [mac80211]\n RIP: 0010:rcu_note_context_switch+0x571/0x5d0\n Call Trace:\n  <TASK>\n  __schedule+0xb0/0x1460\n  ? __mod_timer+0x116/0x360\n  schedule+0x5a/0xc0\n  schedule_timeout+0x87/0x150\n  ? trace_raw_output_tick_stop+0x60/0x60\n  wait_for_completion_timeout+0x7b/0x140\n  usb_start_wait_urb+0x82/0x160 [usbcore\n  usb_control_msg+0xe3/0x140 [usbcore\n  rtw_usb_read+0x88/0xe0 [rtw_usb\n  rtw_usb_read8+0xf/0x10 [rtw_usb\n  rtw_fw_send_h2c_command+0xa0/0x170 [rtw_core\n  rtw_fw_send_ra_info+0xc9/0xf0 [rtw_core\n  drv_sta_rc_update+0x7c/0x160 [mac80211\n  ieee80211_chan_bw_change+0xfb/0x110 [mac80211\n  ieee80211_change_chanctx+0x38/0x130 [mac80211\n  ieee80211_vif_use_reserved_switch+0x34e/0x900 [mac80211\n  ieee80211_link_use_reserved_context+0x88/0xe0 [mac80211\n  ieee80211_chswitch_work+0x95/0x170 [mac80211\n  process_one_work+0x201/0x410\n  worker_thread+0x4a/0x3b0\n  ? process_one_work+0x410/0x410\n  kthread+0xe1/0x110\n  ? kthread_complete_and_exit+0x20/0x20\n  ret_from_fork+0x1f/0x30\n  </TASK>\n\n## Affected\n\n- `Linux >= c1edc86472fc3a5aa3b5c5c53c4e20f6a24992a6 < 107677a8f43521e33e4a653e50fdf55ba622a4ce`\n- `Linux >= c1edc86472fc3a5aa3b5c5c53c4e20f6a24992a6 < dd3af22323e79a2ffabed366db20aab83716fe6f`\n- `Linux >= c1edc86472fc3a5aa3b5c5c53c4e20f6a24992a6 < bcafcb959a57a6890e900199690c5fc47da1a304`\n- `Linux 5.19`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":48,"depthScoreParts":{"impact":48.4,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}