CVE-2026-72005: wifi: rt2x00: avoid full teardown before work setup in probe

From: Greg Kroah-Hartman <[email protected]>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

wifi: rt2x00: avoid full teardown before work setup in probe

rt2x00lib_probe_dev() uses the full rt2x00lib_remove_dev() teardown for
all probe failures. However, drv_data allocation and workqueue allocation
can fail before intf_work, autowakeup_work and sleep_work have been
initialized.

Do not enter the full remove path until the probe has reached the point
where those work items are set up. Return directly for drv_data allocation
failure, and use a small early cleanup path for workqueue allocation
failure.

This issue was found by our static analysis tool and then confirmed by
manual review of rt2x00lib_probe_dev() and rt2x00lib_remove_dev(). The
early probe exits should not call a common teardown path that assumes the
later work setup has already completed.

A QEMU PoC forced alloc_ordered_workqueue() to fail before the work
initializers are reached. The resulting fail path entered
rt2x00lib_remove_dev(), and DEBUG_OBJECTS reported invalid work drains with
rt2x00lib_probe_dev() and rt2x00lib_remove_dev() in the stack.

The Linux kernel CVE team has assigned CVE-2026-72005 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 2.6.39 with commit 0439f5367c8d8bb2ebaca8d7329f51f3148b2fb2 and fixed in 5.10.261 with commit 8b58d1f1356df6a7d2de3f55bb665b18b04ffda0
	Issue introduced in 2.6.39 with commit 0439f5367c8d8bb2ebaca8d7329f51f3148b2fb2 and fixed in 5.15.212 with commit 59afe6148927395cf86f9429900e029a48b1d42b
	Issue introduced in 2.6.39 with commit 0439f5367c8d8bb2ebaca8d7329f51f3148b2fb2 and fixed in 6.1.178 with commit 3c0427d719bddb33caf18ff4ffb77cb47de7eb00
	Issue introduced in 2.6.39 with commit 0439f5367c8d8bb2ebaca8d7329f51f3148b2fb2 and fixed in 6.6.145 with commit eb7474d0253bb2de4793e1d3ce833e8564bbe732
	Issue introduced in 2.6.39 with commit 0439f5367c8d8bb2ebaca8d7329f51f3148b2fb2 and fixed in 6.12.97 with commit 66bd9b1a72de7c2f5141b02d796048aafaed8a49
	Issue introduced in 2.6.39 with commit 0439f5367c8d8bb2ebaca8d7329f51f3148b2fb2 and fixed in 6.18.40 with commit 816559409e340acaa5c9d868291dab30d8c80263
	Issue introduced in 2.6.39 with commit 0439f5367c8d8bb2ebaca8d7329f51f3148b2fb2 and fixed in 7.1.5 with commit 56994852d704535ea354a4627ca667b1b4fa0deb
	Issue introduced in 2.6.39 with commit 0439f5367c8d8bb2ebaca8d7329f51f3148b2fb2 and fixed in 7.2-rc4 with commit 536fb3d739d75a03cb318c0c6fe799425cfea501

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-72005
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/net/wireless/ralink/rt2x00/rt2x00dev.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/8b58d1f1356df6a7d2de3f55bb665b18b04ffda0
	https://git.kernel.org/stable/c/59afe6148927395cf86f9429900e029a48b1d42b
	https://git.kernel.org/stable/c/3c0427d719bddb33caf18ff4ffb77cb47de7eb00
	https://git.kernel.org/stable/c/eb7474d0253bb2de4793e1d3ce833e8564bbe732
	https://git.kernel.org/stable/c/66bd9b1a72de7c2f5141b02d796048aafaed8a49
	https://git.kernel.org/stable/c/816559409e340acaa5c9d868291dab30d8c80263
	https://git.kernel.org/stable/c/56994852d704535ea354a4627ca667b1b4fa0deb
	https://git.kernel.org/stable/c/536fb3d739d75a03cb318c0c6fe799425cfea501