CVE-2023-54071

Vulnerability

Overview

In the Linux kernel's rtw88 wireless driver, the ieee80211_ops::sta_rc_update callback was implemented in a way that could perform a voluntary context switch (e.g., sleeping) while inside an RCU read-side critical section. This violates RCU rules and triggers a kernel warning: "Voluntary context switch within RCU read-side critical section!" [1].

Root

Cause and Exploitation

The issue occurs because ieee80211_chan_bw_change() holds an RCU read lock while calling drv_sta_rc_update(). The rtw88 driver's implementation of this callback could perform USB control message transfers (via rtw_usb_read8 and rtw_fw_send_h2c_command), which can sleep waiting for completion. This sleeping inside the RCU section leads to the warning. No special attacker prerequisites are needed; the bug can be triggered during normal channel switching operations in a wireless environment.

Impact

An attacker who can influence channel switching events (e.g., by sending appropriate wireless frames) could trigger this kernel warning repeatedly. While the warning itself does not directly cause a crash, it indicates a violation of kernel synchronization rules that could lead to unpredictable behavior or system instability. The call trace shows the path from ieee80211_chswitch_work through the driver's rate update code.

Mitigation

The fix, committed to the Linux kernel stable tree, moves the rate update work from the atomic RCU context to a workqueue, ensuring that sleeping operations are performed outside the RCU critical section [1]. Users should apply the kernel patch or update to a version containing commit 107677a8f43521e33e4a653e50fdf50fdf55ba622a4ce.