1. Home
  2. Vulnerabilities
  3. CVE-2026-72005
7.8
HIGH CVSS 3.1
CVE-2026-72005
wifi: rt2x00: avoid full teardown before work setup in probe
Overview
Description

In the Linux kernel, the following vulnerability has been resolved: wifi: rt2x00: avoid full teardown before work setup in probe rt2x00lib_probe_dev() uses the full rt2x00lib_remove_dev() teardown for all probe failures. However, drv_data allocation and workqueue allocation can fail before intf_work, autowakeup_work and sleep_work have been initialized. Do not enter the full remove path until the probe has reached the point where those work items are set up. Return directly for drv_data allocation failure, and use a small early cleanup path for workqueue allocation failure. This issue was found by our static analysis tool and then confirmed by manual review of rt2x00lib_probe_dev() and rt2x00lib_remove_dev(). The early probe exits should not call a common teardown path that assumes the later work setup has already completed. A QEMU PoC forced alloc_ordered_workqueue() to fail before the work initializers are reached. The resulting fail path entered rt2x00lib_remove_dev(), and DEBUG_OBJECTS reported invalid work drains with rt2x00lib_probe_dev() and rt2x00lib_remove_dev() in the stack.

Details
INFO

Published Date :

Aug. 15, 2026, 6:20 a.m.

Last Modified :

Aug. 17, 2026, 6:17 a.m.

Remotely Exploit :

No

Source :

416baaa9-dc9f-4396-8d5f-8c081fb06d67
Impact
Affected Products

The following products are affected by CVE-2026-72005 vulnerability. Even if cvefeed.io is aware of the exact versions of the products that are affected, the information is not represented in the table below.

ID Vendor Product Action
1 Linux linux_kernel
: Total Affected Vendor : 1 | Products : 1
Scoring
CVSS Scores
The Common Vulnerability Scoring System is a standardized framework for assessing the severity of vulnerabilities in software and systems. We collect and displays CVSS scores from various sources for each CVE.
Score Version Severity Vector Exploitability Score Impact Score Source
CVSS 3.1 HIGH 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Solution
Modify probe function to avoid full teardown before work setup.
  • Do not call full remove path before work items are initialized.
  • Return directly for drv_data allocation failure.
  • Use early cleanup for workqueue allocation failure.
References
References to Advisories, Solutions, and Tools

Here, you will find a curated list of external links that provide in-depth information, practical solutions, and valuable tools related to CVE-2026-72005.

URL Resource
https://git.kernel.org/stable/c/3c0427d719bddb33caf18ff4ffb77cb47de7eb00
https://git.kernel.org/stable/c/536fb3d739d75a03cb318c0c6fe799425cfea501
https://git.kernel.org/stable/c/56994852d704535ea354a4627ca667b1b4fa0deb
https://git.kernel.org/stable/c/59afe6148927395cf86f9429900e029a48b1d42b
https://git.kernel.org/stable/c/66bd9b1a72de7c2f5141b02d796048aafaed8a49
https://git.kernel.org/stable/c/816559409e340acaa5c9d868291dab30d8c80263
https://git.kernel.org/stable/c/8b58d1f1356df6a7d2de3f55bb665b18b04ffda0
https://git.kernel.org/stable/c/eb7474d0253bb2de4793e1d3ce833e8564bbe732
CWE - Common Weakness Enumeration

While CVE identifies specific instances of vulnerabilities, CWE categorizes the common flaws or weaknesses that can lead to vulnerabilities. CVE-2026-72005 is associated with the following CWEs:

Common Attack Pattern Enumeration and Classification (CAPEC)

Common Attack Pattern Enumeration and Classification (CAPEC) stores attack patterns, which are descriptions of the common attributes and approaches employed by adversaries to exploit the CVE-2026-72005 weaknesses.

We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).

Results are limited to the first 15 repositories due to potential performance issues.

The following list is the news that have been mention CVE-2026-72005 vulnerability anywhere in the article.

Results are limited to the first 20 news articles due to potential performance issues.

The following table lists the changes that have been made to the CVE-2026-72005 vulnerability over time.

Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.

  • CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67

    Aug. 17, 2026

    Action Type Old Value New Value
    Added CVSS V3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
    Changed Affected [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '0439f5367c8d8bb2ebaca8d7329f51f3148b2fb2', 'lessThan': '8b58d1f1356df6a7d2de3f55bb665b18b04ffda0', 'versionType': 'git'}, {'status': 'affected', 'version': '0439f5367c8d8bb2ebaca8d7329f51f3148b2fb2', 'lessThan': '59afe6148927395cf86f9429900e029a48b1d42b', 'versionType': 'git'}, {'status': 'affected', 'version': '0439f5367c8d8bb2ebaca8d7329f51f3148b2fb2', 'lessThan': '3c0427d719bddb33caf18ff4ffb77cb47de7eb00', 'versionType': 'git'}, {'status': 'affected', 'version': '0439f5367c8d8bb2ebaca8d7329f51f3148b2fb2', 'lessThan': 'eb7474d0253bb2de4793e1d3ce833e8564bbe732', 'versionType': 'git'}, {'status': 'affected', 'version': '0439f5367c8d8bb2ebaca8d7329f51f3148b2fb2', 'lessThan': '66bd9b1a72de7c2f5141b02d796048aafaed8a49', 'versionType': 'git'}, {'status': 'affected', 'version': '0439f5367c8d8bb2ebaca8d7329f51f3148b2fb2', 'lessThan': '816559409e340acaa5c9d868291dab30d8c80263', 'versionType': 'git'}, {'status': 'affected', 'version': '0439f5367c8d8bb2ebaca8d7329f51f3148b2fb2', 'lessThan': '56994852d704535ea354a4627ca667b1b4fa0deb', 'versionType': 'git'}, {'status': 'affected', 'version': '0439f5367c8d8bb2ebaca8d7329f51f3148b2fb2', 'lessThan': '536fb3d739d75a03cb318c0c6fe799425cfea501', 'versionType': 'git'}], 'programFiles': ['drivers/net/wireless/ralink/rt2x00/rt2x00dev.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '2.6.39'}, {'status': 'unaffected', 'version': '0', 'lessThan': '2.6.39', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '5.10.261', 'versionType': 'semver', 'lessThanOrEqual': '5.10.*'}, {'status': 'unaffected', 'version': '5.15.212', 'versionType': 'semver', 'lessThanOrEqual': '5.15.*'}, {'status': 'unaffected', 'version': '6.1.178', 'versionType': 'semver', 'lessThanOrEqual': '6.1.*'}, {'status': 'unaffected', 'version': '6.6.145', 'versionType': 'semver', 'lessThanOrEqual': '6.6.*'}, {'status': 'unaffected', 'version': '6.12.97', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.40', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.1.5', 'versionType': 'semver', 'lessThanOrEqual': '7.1.*'}, {'status': 'unaffected', 'version': '7.2-rc4', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['drivers/net/wireless/ralink/rt2x00/rt2x00dev.c'], 'defaultStatus': 'affected'}] [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '0439f5367c8d8bb2ebaca8d7329f51f3148b2fb2', 'lessThan': '8b58d1f1356df6a7d2de3f55bb665b18b04ffda0', 'versionType': 'git'}, {'status': 'affected', 'version': '0439f5367c8d8bb2ebaca8d7329f51f3148b2fb2', 'lessThan': '59afe6148927395cf86f9429900e029a48b1d42b', 'versionType': 'git'}, {'status': 'affected', 'version': '0439f5367c8d8bb2ebaca8d7329f51f3148b2fb2', 'lessThan': '3c0427d719bddb33caf18ff4ffb77cb47de7eb00', 'versionType': 'git'}, {'status': 'affected', 'version': '0439f5367c8d8bb2ebaca8d7329f51f3148b2fb2', 'lessThan': 'eb7474d0253bb2de4793e1d3ce833e8564bbe732', 'versionType': 'git'}, {'status': 'affected', 'version': '0439f5367c8d8bb2ebaca8d7329f51f3148b2fb2', 'lessThan': '66bd9b1a72de7c2f5141b02d796048aafaed8a49', 'versionType': 'git'}, {'status': 'affected', 'version': '0439f5367c8d8bb2ebaca8d7329f51f3148b2fb2', 'lessThan': '816559409e340acaa5c9d868291dab30d8c80263', 'versionType': 'git'}, {'status': 'affected', 'version': '0439f5367c8d8bb2ebaca8d7329f51f3148b2fb2', 'lessThan': '56994852d704535ea354a4627ca667b1b4fa0deb', 'versionType': 'git'}, {'status': 'affected', 'version': '0439f5367c8d8bb2ebaca8d7329f51f3148b2fb2', 'lessThan': '536fb3d739d75a03cb318c0c6fe799425cfea501', 'versionType': 'git'}], 'programFiles': ['drivers/net/wireless/ralink/rt2x00/rt2x00dev.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '2.6.39'}, {'status': 'unaffected', 'version': '0', 'lessThan': '2.6.39', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '5.10.261', 'versionType': 'semver', 'lessThanOrEqual': '5.10.*'}, {'status': 'unaffected', 'version': '5.15.212', 'versionType': 'semver', 'lessThanOrEqual': '5.15.*'}, {'status': 'unaffected', 'version': '6.1.178', 'versionType': 'semver', 'lessThanOrEqual': '6.1.*'}, {'status': 'unaffected', 'version': '6.6.145', 'versionType': 'semver', 'lessThanOrEqual': '6.6.*'}, {'status': 'unaffected', 'version': '6.12.97', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.40', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.1.5', 'versionType': 'semver', 'lessThanOrEqual': '7.1.*'}, {'status': 'unaffected', 'version': '7.2', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['drivers/net/wireless/ralink/rt2x00/rt2x00dev.c'], 'defaultStatus': 'affected'}]
  • New CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67

    Aug. 15, 2026

    Action Type Old Value New Value
    Added Affected [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '0439f5367c8d8bb2ebaca8d7329f51f3148b2fb2', 'lessThan': '8b58d1f1356df6a7d2de3f55bb665b18b04ffda0', 'versionType': 'git'}, {'status': 'affected', 'version': '0439f5367c8d8bb2ebaca8d7329f51f3148b2fb2', 'lessThan': '59afe6148927395cf86f9429900e029a48b1d42b', 'versionType': 'git'}, {'status': 'affected', 'version': '0439f5367c8d8bb2ebaca8d7329f51f3148b2fb2', 'lessThan': '3c0427d719bddb33caf18ff4ffb77cb47de7eb00', 'versionType': 'git'}, {'status': 'affected', 'version': '0439f5367c8d8bb2ebaca8d7329f51f3148b2fb2', 'lessThan': 'eb7474d0253bb2de4793e1d3ce833e8564bbe732', 'versionType': 'git'}, {'status': 'affected', 'version': '0439f5367c8d8bb2ebaca8d7329f51f3148b2fb2', 'lessThan': '66bd9b1a72de7c2f5141b02d796048aafaed8a49', 'versionType': 'git'}, {'status': 'affected', 'version': '0439f5367c8d8bb2ebaca8d7329f51f3148b2fb2', 'lessThan': '816559409e340acaa5c9d868291dab30d8c80263', 'versionType': 'git'}, {'status': 'affected', 'version': '0439f5367c8d8bb2ebaca8d7329f51f3148b2fb2', 'lessThan': '56994852d704535ea354a4627ca667b1b4fa0deb', 'versionType': 'git'}, {'status': 'affected', 'version': '0439f5367c8d8bb2ebaca8d7329f51f3148b2fb2', 'lessThan': '536fb3d739d75a03cb318c0c6fe799425cfea501', 'versionType': 'git'}], 'programFiles': ['drivers/net/wireless/ralink/rt2x00/rt2x00dev.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '2.6.39'}, {'status': 'unaffected', 'version': '0', 'lessThan': '2.6.39', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '5.10.261', 'versionType': 'semver', 'lessThanOrEqual': '5.10.*'}, {'status': 'unaffected', 'version': '5.15.212', 'versionType': 'semver', 'lessThanOrEqual': '5.15.*'}, {'status': 'unaffected', 'version': '6.1.178', 'versionType': 'semver', 'lessThanOrEqual': '6.1.*'}, {'status': 'unaffected', 'version': '6.6.145', 'versionType': 'semver', 'lessThanOrEqual': '6.6.*'}, {'status': 'unaffected', 'version': '6.12.97', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.40', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.1.5', 'versionType': 'semver', 'lessThanOrEqual': '7.1.*'}, {'status': 'unaffected', 'version': '7.2-rc4', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['drivers/net/wireless/ralink/rt2x00/rt2x00dev.c'], 'defaultStatus': 'affected'}]
    Added Description In the Linux kernel, the following vulnerability has been resolved: wifi: rt2x00: avoid full teardown before work setup in probe rt2x00lib_probe_dev() uses the full rt2x00lib_remove_dev() teardown for all probe failures. However, drv_data allocation and workqueue allocation can fail before intf_work, autowakeup_work and sleep_work have been initialized. Do not enter the full remove path until the probe has reached the point where those work items are set up. Return directly for drv_data allocation failure, and use a small early cleanup path for workqueue allocation failure. This issue was found by our static analysis tool and then confirmed by manual review of rt2x00lib_probe_dev() and rt2x00lib_remove_dev(). The early probe exits should not call a common teardown path that assumes the later work setup has already completed. A QEMU PoC forced alloc_ordered_workqueue() to fail before the work initializers are reached. The resulting fail path entered rt2x00lib_remove_dev(), and DEBUG_OBJECTS reported invalid work drains with rt2x00lib_probe_dev() and rt2x00lib_remove_dev() in the stack.
    Added Reference https://git.kernel.org/stable/c/3c0427d719bddb33caf18ff4ffb77cb47de7eb00
    Added Reference https://git.kernel.org/stable/c/536fb3d739d75a03cb318c0c6fe799425cfea501
    Added Reference https://git.kernel.org/stable/c/56994852d704535ea354a4627ca667b1b4fa0deb
    Added Reference https://git.kernel.org/stable/c/59afe6148927395cf86f9429900e029a48b1d42b
    Added Reference https://git.kernel.org/stable/c/66bd9b1a72de7c2f5141b02d796048aafaed8a49
    Added Reference https://git.kernel.org/stable/c/816559409e340acaa5c9d868291dab30d8c80263
    Added Reference https://git.kernel.org/stable/c/8b58d1f1356df6a7d2de3f55bb665b18b04ffda0
    Added Reference https://git.kernel.org/stable/c/eb7474d0253bb2de4793e1d3ce833e8564bbe732
EPSS is a daily estimate of the probability of exploitation activity being observed over the next 30 days. Following chart shows the EPSS score history of the vulnerability.
CVSS
Vulnerability Scoring Details
Base CVSS Score: 7.8
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality Impact
Integrity Impact
Availability Impact