---
id: CVE-2023-54071
title: 'wifi: rtw88: use work to update rate to avoid RCU warning'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  wifi: rtw88: use work to update rate to avoid RCU warning

  The ieee80211_ops::sta_rc_update must be atomic, because
  ieee80211_chan_bw_change() holds rcu_read lock while…
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= c1edc86472fc3a5aa3b5c5c53c4e20f6a24992a6 <
    107677a8f43521e33e4a653e50fdf55ba622a4ce
  - >-
    Linux >= c1edc86472fc3a5aa3b5c5c53c4e20f6a24992a6 <
    dd3af22323e79a2ffabed366db20aab83716fe6f
  - >-
    Linux >= c1edc86472fc3a5aa3b5c5c53c4e20f6a24992a6 <
    bcafcb959a57a6890e900199690c5fc47da1a304
  - Linux 5.19
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-15T21:38:13.834973Z'
published: '2025-12-24'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T21:41:38.954Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2023-54071'
references:
  - url: 'https://git.kernel.org/stable/c/107677a8f43521e33e4a653e50fdf55ba622a4ce'
  - url: 'https://git.kernel.org/stable/c/dd3af22323e79a2ffabed366db20aab83716fe6f'
  - url: 'https://git.kernel.org/stable/c/bcafcb959a57a6890e900199690c5fc47da1a304'
tags:
  - cve.org
epss: 0.00273
epssPercentile: 0.18346
ingestedAt: '2026-10-15T22:48:25.427Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

wifi: rtw88: use work to update rate to avoid RCU warning

The ieee80211_ops::sta_rc_update must be atomic, because
ieee80211_chan_bw_change() holds rcu_read lock while calling
drv_sta_rc_update(), so create a work to do original things.

 Voluntary context switch within RCU read-side critical section!
 WARNING: CPU: 0 PID: 4621 at kernel/rcu/tree_plugin.h:318
 rcu_note_context_switch+0x571/0x5d0
 CPU: 0 PID: 4621 Comm: kworker/u16:2 Tainted: G        W  OE
 Workqueue: phy3 ieee80211_chswitch_work [mac80211]
 RIP: 0010:rcu_note_context_switch+0x571/0x5d0
 Call Trace:
  <TASK>
  __schedule+0xb0/0x1460
  ? __mod_timer+0x116/0x360
  schedule+0x5a/0xc0
  schedule_timeout+0x87/0x150
  ? trace_raw_output_tick_stop+0x60/0x60
  wait_for_completion_timeout+0x7b/0x140
  usb_start_wait_urb+0x82/0x160 [usbcore
  usb_control_msg+0xe3/0x140 [usbcore
  rtw_usb_read+0x88/0xe0 [rtw_usb
  rtw_usb_read8+0xf/0x10 [rtw_usb
  rtw_fw_send_h2c_command+0xa0/0x170 [rtw_core
  rtw_fw_send_ra_info+0xc9/0xf0 [rtw_core
  drv_sta_rc_update+0x7c/0x160 [mac80211
  ieee80211_chan_bw_change+0xfb/0x110 [mac80211
  ieee80211_change_chanctx+0x38/0x130 [mac80211
  ieee80211_vif_use_reserved_switch+0x34e/0x900 [mac80211
  ieee80211_link_use_reserved_context+0x88/0xe0 [mac80211
  ieee80211_chswitch_work+0x95/0x170 [mac80211
  process_one_work+0x201/0x410
  worker_thread+0x4a/0x3b0
  ? process_one_work+0x410/0x410
  kthread+0xe1/0x110
  ? kthread_complete_and_exit+0x20/0x20
  ret_from_fork+0x1f/0x30
  </TASK>

## Affected

- `Linux >= c1edc86472fc3a5aa3b5c5c53c4e20f6a24992a6 < 107677a8f43521e33e4a653e50fdf55ba622a4ce`
- `Linux >= c1edc86472fc3a5aa3b5c5c53c4e20f6a24992a6 < dd3af22323e79a2ffabed366db20aab83716fe6f`
- `Linux >= c1edc86472fc3a5aa3b5c5c53c4e20f6a24992a6 < bcafcb959a57a6890e900199690c5fc47da1a304`
- `Linux 5.19`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.