CVE-2026-72005

In the Linux kernel, the following vulnerability has been resolved:

wifi: rt2x00: avoid full teardown before work setup in probe

rt2x00libprobedev() uses the full rt2x00libremovedev() teardown for all probe failures. However, drvdata allocation and workqueue allocation can fail before intfwork, autowakeupwork and sleepwork have been initialized.

Do not enter the full remove path until the probe has reached the point where those work items are set up. Return directly for drv_data allocation failure, and use a small early cleanup path for workqueue allocation failure.

This issue was found by our static analysis tool and then confirmed by manual review of rt2x00libprobedev() and rt2x00libremovedev(). The early probe exits should not call a common teardown path that assumes the later work setup has already completed.

A QEMU PoC forced allocorderedworkqueue() to fail before the work initializers are reached. The resulting fail path entered rt2x00libremovedev(), and DEBUGOBJECTS reported invalid work drains with rt2x00libprobedev() and rt2x00libremove_dev() in the stack.