Linux Kernel rtw89 Wi-Fi Driver Null Pointer Dereference and Use-After-Free Vulnerability

A race condition vulnerability has been identified in the Linux kernel's rtw89 Wi-Fi driver. The issue arises when the 'scanning' flag is not properly protected by a mutex, allowing the 'cancel_hw_scan' function to interfere with the 'hw_scan' completion process. This interference can lead to a null pointer dereference and a use-after-free condition, as the 'hw_scan' completion unsets the flag and frees the scan request, while 'cancel_hw_scan' may still be attempting to access it.

Impact

Exploitation of this vulnerability causes a null pointer dereference and a use-after-free condition, which can lead to memory corruption and potentially allow for arbitrary code execution.