CVE-2026-93796: Linux kernel iwlwifi PCIe UAF/double-free — iwl pcie rx free leaves freed RX pointers rx pool, global table, rxq, alloc page non-NULL after free

The Linux kernel iwlwifi PCIe transport frees its RX bookkeeping objects in iwl_pcie_rx_free() (drivers/net/wireless/intel/iwlwifi/pcie/gen1_2/rx.c, older trees: pcie/rx.c) but never invalidates the pointers on the still-live struct iwl_trans_pcie. The function's own re-entry guard uses trans_pcie->rxq == NULL as the "nothing allocated" sentinel, so after a first free — performed on the nic-init error unwind when iwl_pcie_tx_init() fails inside iwl_pcie_nic_init() — any later teardown or retry path (interface down/up, driver unbind/rebind, reprobe, suspend/resume, error recovery) that calls iwl_pcie_rx_free() again passes the guard and re-frees rx_pool, global_table, rxq (kfree) and alloc_page (__free_pages), producing a double-free, and dereferences the freed rx_pool[]/rxq[] arrays, producing a slab use-after-free (CWE-416, with missing pointer invalidation CWE-459).

• Component: Linux kernel iwlwifi PCIe transport (drivers/net/wireless/intel/iwlwifi/pcie/gen1_2/rx.c).
• Affected versions: < 6.12.111; 6.13.0 – 6.18.53; 6.19.0 – 7.1.x.
• Fixed in: 6.12.111 (6ec5bf430cf7466cb412e47f2761594092781fac), 6.18.53 (3456c5bcc987aeb182e50e30c9b02be8420e9953), upstream 7.2 (2c79d7a7b583050c9f58041465cb46fe3483ab5d).
• Consequences: kernel memory corruption (double-free / slab use-after-free) in the WiFi driver teardown path — kernel crash (DoS) and a potentially exploitable heap corruption primitive on systems with Intel WiFi PCIe hardware. This run confirms memory corruption only; no code execution is claimed.

Impact Parity

• Disclosed/claimed maximum impact: memory corruption (double-free / UAF) — KASAN-detectable; the advisory does not claim RCE.
• Reproduced impact this run: on the v6.18.52 KASAN+SLUB_DEBUG+DEBUG_OBJECTS kernel the second iwl_pcie_rx_free() produced (a) a KASAN use-after-free 8-byte read of the freed rx_pool in iwl_pcie_free_rbs_pool <- iwl_pcie_rx_free [iwlwifi], (b) a BAD_PAGE taint from the repeated __free_pages(alloc_page), and (c) a kernel oops (NULL/wild dereference in dma_free_attrs <- iwl_pcie_free_rxq_dma <- iwl_pcie_rx_free) from walking the freed rxq[] state. The identical trigger on the fixed kernel completes cleanly 2/2 (negative control).
• Parity: full for the claimed memory-corruption impact class.
• Not demonstrated: code execution (out of scope per the advisory/ticket).

Root Cause

iwl_pcie_rx_free() (v6.18.52, rx.c line 1204) ends with:

	kfree(trans_pcie->rx_pool);
	kfree(trans_pcie->global_table);
	kfree(trans_pcie->rxq);

	if (trans_pcie->alloc_page)
		__free_pages(trans_pcie->alloc_page, trans_pcie->rx_page_order);

None of the four freed members are set to NULL, yet the function starts with:

	if (!trans_pcie->rxq) {
		IWL_DEBUG_INFO(trans, "Free NULL rx context\n");
		return;
	}

The first call (nic-init unwind after a TX-init failure) frees everything but leaves rxq non-NULL, defeating the sentinel. A second call on the same live transport object walks the freed rxq[]/rx_pool[] arrays (iwl_pcie_free_rbs_pool() reads rx_pool[i].page, the queue loop reads rxq->bd/rxq->napi.poll) and then kfree()s the same three pointers again and re-frees alloc_page — UAF reads plus double-frees.

The fix (upstream 2c79d7a7b583050c9f58041465cb46fe3483ab5d, "wifi: iwlwifi: pcie: null RX pointers after free", Emmanuel Grumbach, Intel) sets rx_pool, global_table, rxq and alloc_page to NULL immediately after freeing, so repeated cleanup and retry paths fail safe on the sentinel.

Reproduction Steps

1. bundle/repro/reproduction_steps.sh (self-contained; see that file).
2. The script:
   • clones linux-stable v6.18.52 (vulnerable) into the prepared project cache;
   • verifies iwl_pcie_rx_free() lacks the pointer-NULLing fix;
   • because QEMU cannot emulate an Intel WiFi PCIe device (explicitly anticipated by the ticket), patches a hardware-independent selftest trigger into the real driver (pcie/gen1_2/rxfree-selftest.c + a rx_free_selftest=1 module-parameter hook in iwl_drv_init()): it builds RX state exactly as iwl_pcie_rx_alloc() does (kcalloc of rxq/rx_pool/global_table, alloc_pages for alloc_page, initialised RB-allocator work/lists) and then calls the real, unmodified iwl_pcie_rx_free() twice — first = nic-init unwind after iwl_pcie_tx_init() failure, second = later teardown/retry on the same live transport object;
   • builds a defconfig+KASAN(outline)+SLUB_DEBUG+DEBUG_OBJECTS kernel with CONFIG_IWLWIFI=m, producing a vulnerable iwlwifi.ko; then applies the stable fix hunk to rx.c and rebuilds a fixed iwlwifi.ko against the same kernel;
   • boots the kernel twice per build in QEMU/KVM with a busybox initramfs that insmods the module with rx_free_selftest=1, capturing the serial log.
3. Expected evidence: vulnerable boots emit BUG: KASAN: use-after-free in iwl_pcie_free_rbs_pool <- iwl_pcie_rx_free ([iwlwifi]) followed by a BAD_PAGE taint and a fatal oops in iwl_pcie_free_rxq_dma; fixed boots print SELFTEST-COMPLETE with all four pointers NULLed and no KASAN splat.

Evidence

• bundle/logs/vm_vuln_attempt1.log, bundle/logs/vm_vuln_attempt2.log — KASAN splats naming the RX teardown path (2/2 attempts).
• bundle/logs/vm_fixed_attempt1.log, bundle/logs/vm_fixed_attempt2.log — negative control, selftest completes cleanly (2/2 attempts).
• bundle/logs/build_bzimage.log, bundle/logs/build_mod_vuln.log, bundle/logs/build_mod_fixed.log — build transcripts.
• bundle/repro/runtime_manifest.json — runtime evidence manifest with artifact hashes and immutable target identity (git:https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8f3741e6feb045da5b406df0a80b42a1adfb289b = v6.18.52).
• Environment: x86_64, QEMU/KVM (-machine accel=kvm:tcg), KASAN outline, SLUB_DEBUG, DEBUG_OBJECTS(_FREE/_TIMERS) enabled.

Recommendations / Next Steps

• Backport/apply upstream 2c79d7a7b583050c9f58041465cb46fe3483ab5d ("null RX pointers after free") — already in 6.12.111 / 6.18.53 / 7.2.
• Upgrade affected kernels to >= 6.12.111 / >= 6.18.53 / >= 7.2.
• Regression test: an in-tree KUnit or error-injection test that forces iwl_pcie_tx_init() failure and then re-runs teardown would lock the invariant "rx free is idempotent" in.

Additional Notes

• Idempotency: the script is re-runnable; it restores rx.c to the vulnerable state, caches the bzImage and both module builds in the project cache, and re-executes fresh QEMU proofs on every run.
• Evidence scope: QEMU exposes no Intel WiFi PCIe device, so the trigger is a patched-in selftest that executes the real vulnerable function with faithful allocator state — matching the ticket's explicit fallback ("reproduce the unwind/retry sequence with a patched-in test trigger … state the scope honestly"). The double-free/UAF depends only on the pointer invalidation bug in iwl_pcie_rx_free(), not on hardware behavior: on real hardware the same two calls are reached via nic-init unwind + teardown/retry.
• Scope: memory corruption only; RCE is not claimed and was not attempted.