CVE-2026-80947

A use-after-free in the Linux kernel's rtl8xxxu USB WiFi driver occurs when the rx_urb_wq workqueue worker runs after rtl8xxxu_disconnect() frees the private driver data (priv) via ieee80211_free_hw(). The root cause is that rtl8xxxu_stop() cancels sibling work items but never cancels rx_urb_wq, ...