CVE-2026-43213 (GCVE-0-2026-43213)

Vulnerability from cvelistv5 – Published: 2026-05-06 11:28 – Updated: 2026-08-05 12:26
VLAI
Title
wifi: rtw89: pci: validate sequence number of TX release report
Summary
In the Linux kernel, the following vulnerability has been resolved: wifi: rtw89: pci: validate sequence number of TX release report Hardware rarely reports abnormal sequence number in TX release report, which will access out-of-bounds of wd_ring->pages array, causing NULL pointer dereference. BUG: kernel NULL pointer dereference, address: 0000000000000000 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 0 P4D 0 Oops: 0000 [#1] PREEMPT SMP NOPTI CPU: 1 PID: 1085 Comm: irq/129-rtw89_p Tainted: G S U 6.1.145-17510-g2f3369c91536 #1 (HASH:69e8 1) Call Trace: <IRQ> rtw89_pci_release_tx+0x18f/0x300 [rtw89_pci (HASH:4c83 2)] rtw89_pci_napi_poll+0xc2/0x190 [rtw89_pci (HASH:4c83 2)] net_rx_action+0xfc/0x460 net/core/dev.c:6578 net/core/dev.c:6645 net/core/dev.c:6759 handle_softirqs+0xbe/0x290 kernel/softirq.c:601 ? rtw89_pci_interrupt_threadfn+0xc5/0x350 [rtw89_pci (HASH:4c83 2)] __local_bh_enable_ip+0xeb/0x120 kernel/softirq.c:499 kernel/softirq.c:423 </IRQ> <TASK> rtw89_pci_interrupt_threadfn+0xf8/0x350 [rtw89_pci (HASH:4c83 2)] ? irq_thread+0xa7/0x340 kernel/irq/manage.c:0 irq_thread+0x177/0x340 kernel/irq/manage.c:1205 kernel/irq/manage.c:1314 ? thaw_kernel_threads+0xb0/0xb0 kernel/irq/manage.c:1202 ? irq_forced_thread_fn+0x80/0x80 kernel/irq/manage.c:1220 kthread+0xea/0x110 kernel/kthread.c:376 ? synchronize_irq+0x1a0/0x1a0 kernel/irq/manage.c:1287 ? kthread_associate_blkcg+0x80/0x80 kernel/kthread.c:331 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295 </TASK> To prevent crash, validate rpp_info.seq before using.
Severity
7.5 (High)
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: e3ec7017f6a20d12ddd9fe23d345ebb7b8c104dd , < ef7fa19809b2d892d45da53f90ac698d13c367fd (git)
Affected: e3ec7017f6a20d12ddd9fe23d345ebb7b8c104dd , < b342dd13aedccb0dd27365f6cc63a262f42394ce (git)
Affected: e3ec7017f6a20d12ddd9fe23d345ebb7b8c104dd , < 957eda596c7665f2966970fd1dcc35fe299b38e8 (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.16
Unaffected: 0 , < 5.16 (semver)
Unaffected: 6.18.16 , ≤ 6.18.* (semver)
Unaffected: 6.19.6 , ≤ 6.19.* (semver)
Unaffected: 7.0 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wireless/realtek/rtw89/pci.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "ef7fa19809b2d892d45da53f90ac698d13c367fd",
              "status": "affected",
              "version": "e3ec7017f6a20d12ddd9fe23d345ebb7b8c104dd",
              "versionType": "git"
            },
            {
              "lessThan": "b342dd13aedccb0dd27365f6cc63a262f42394ce",
              "status": "affected",
              "version": "e3ec7017f6a20d12ddd9fe23d345ebb7b8c104dd",
              "versionType": "git"
            },
            {
              "lessThan": "957eda596c7665f2966970fd1dcc35fe299b38e8",
              "status": "affected",
              "version": "e3ec7017f6a20d12ddd9fe23d345ebb7b8c104dd",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wireless/realtek/rtw89/pci.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.16"
            },
            {
              "lessThan": "5.16",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.16",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.16",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.6",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: rtw89: pci: validate sequence number of TX release report\n\nHardware rarely reports abnormal sequence number in TX release report,\nwhich will access out-of-bounds of wd_ring-\u003epages array, causing NULL\npointer dereference.\n\n  BUG: kernel NULL pointer dereference, address: 0000000000000000\n  #PF: supervisor read access in kernel mode\n  #PF: error_code(0x0000) - not-present page\n  PGD 0 P4D 0\n  Oops: 0000 [#1] PREEMPT SMP NOPTI\n  CPU: 1 PID: 1085 Comm: irq/129-rtw89_p Tainted: G S   U\n             6.1.145-17510-g2f3369c91536 #1 (HASH:69e8 1)\n  Call Trace:\n   \u003cIRQ\u003e\n   rtw89_pci_release_tx+0x18f/0x300 [rtw89_pci (HASH:4c83 2)]\n   rtw89_pci_napi_poll+0xc2/0x190 [rtw89_pci (HASH:4c83 2)]\n   net_rx_action+0xfc/0x460 net/core/dev.c:6578 net/core/dev.c:6645 net/core/dev.c:6759\n   handle_softirqs+0xbe/0x290 kernel/softirq.c:601\n   ? rtw89_pci_interrupt_threadfn+0xc5/0x350 [rtw89_pci (HASH:4c83 2)]\n   __local_bh_enable_ip+0xeb/0x120 kernel/softirq.c:499 kernel/softirq.c:423\n   \u003c/IRQ\u003e\n   \u003cTASK\u003e\n   rtw89_pci_interrupt_threadfn+0xf8/0x350 [rtw89_pci (HASH:4c83 2)]\n   ? irq_thread+0xa7/0x340 kernel/irq/manage.c:0\n   irq_thread+0x177/0x340 kernel/irq/manage.c:1205 kernel/irq/manage.c:1314\n   ? thaw_kernel_threads+0xb0/0xb0 kernel/irq/manage.c:1202\n   ? irq_forced_thread_fn+0x80/0x80 kernel/irq/manage.c:1220\n   kthread+0xea/0x110 kernel/kthread.c:376\n   ? synchronize_irq+0x1a0/0x1a0 kernel/irq/manage.c:1287\n   ? kthread_associate_blkcg+0x80/0x80 kernel/kthread.c:331\n   ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295\n   \u003c/TASK\u003e\n\nTo prevent crash, validate rpp_info.seq before using."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:A - The vulnerable path is the rtw89 PCI WiFi TX release-report path reached from the device RPQ interrupt/NAPI handler after wireless transmissions. In AP or client deployments, an unauthenticated radio-range attacker can plausibly induce repeated TX completions by injecting or eliciting WiFi traffic.\nAC:H - The code path is deterministic once a malformed release report with an out-of-range sequence number is produced. However, the malformed sequence is described as a rare hardware/firmware report and is not directly chosen by the attacker.\nPR:N - In the adjacent WiFi attack scenario, the attacker does not need local accounts, capabilities, or authenticated access to the target host. Radio proximity is sufficient to stimulate the vulnerable TX completion path.\nUI:N - No victim action is required once the affected WiFi interface is active. The vulnerable processing occurs asynchronously in interrupt/NAPI context.\nS:U - The impact remains within the kernel and the affected host. There is no VM escape, IOMMU bypass, or cross-authority boundary change.\nC:H - The invalid 15-bit sequence number indexes past the 512-entry wd_ring-\u003epages array and causes adjacent kernel memory to be interpreted as TX descriptor/list/queue state. Conservatively, this out-of-bounds kernel memory access can expose sensitive kernel memory even though the observed failure is a NULL dereference.\nI:H - The out-of-bounds pseudo-TX descriptor can drive list, skb queue, DMA-unmap, status, and enqueue operations using invalid pointer fields. Conservatively, this kernel memory corruption can permit high-integrity impact.\nA:H - The fix commit documents a kernel NULL pointer dereference and oops in rtw89_pci_release_tx from this bug. A kernel crash or panic is a high availability impact."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:26:38.601Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/ef7fa19809b2d892d45da53f90ac698d13c367fd"
        },
        {
          "url": "https://git.kernel.org/stable/c/b342dd13aedccb0dd27365f6cc63a262f42394ce"
        },
        {
          "url": "https://git.kernel.org/stable/c/957eda596c7665f2966970fd1dcc35fe299b38e8"
        }
      ],
      "title": "wifi: rtw89: pci: validate sequence number of TX release report",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-43213",
    "datePublished": "2026-05-06T11:28:15.998Z",
    "dateReserved": "2026-05-01T14:12:55.993Z",
    "dateUpdated": "2026-08-05T12:26:38.601Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-43213",
      "date": "2026-08-22",
      "epss": "0.0022",
      "percentile": "0.12858"
    },
    "microsoft_vex": {
      "current_release_date": "2026-05-19T01:46:06.000Z",
      "cve": "CVE-2026-43213",
      "id": "msrc_CVE-2026-43213",
      "initial_release_date": "2026-05-02T00:00:00.000Z",
      "product_status:known_affected": "2",
      "product_status:known_not_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "wifi: rtw89: pci: validate sequence number of TX release report",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-43213.json",
      "version": "5"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-43213\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-05-06T12:16:40.803\",\"lastModified\":\"2026-06-17T10:49:09.940\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nwifi: rtw89: pci: validate sequence number of TX release report\\n\\nHardware rarely reports abnormal sequence number in TX release report,\\nwhich will access out-of-bounds of wd_ring-\u003epages array, causing NULL\\npointer dereference.\\n\\n  BUG: kernel NULL pointer dereference, address: 0000000000000000\\n  #PF: supervisor read access in kernel mode\\n  #PF: error_code(0x0000) - not-present page\\n  PGD 0 P4D 0\\n  Oops: 0000 [#1] PREEMPT SMP NOPTI\\n  CPU: 1 PID: 1085 Comm: irq/129-rtw89_p Tainted: G S   U\\n             6.1.145-17510-g2f3369c91536 #1 (HASH:69e8 1)\\n  Call Trace:\\n   \u003cIRQ\u003e\\n   rtw89_pci_release_tx+0x18f/0x300 [rtw89_pci (HASH:4c83 2)]\\n   rtw89_pci_napi_poll+0xc2/0x190 [rtw89_pci (HASH:4c83 2)]\\n   net_rx_action+0xfc/0x460 net/core/dev.c:6578 net/core/dev.c:6645 net/core/dev.c:6759\\n   handle_softirqs+0xbe/0x290 kernel/softirq.c:601\\n   ? rtw89_pci_interrupt_threadfn+0xc5/0x350 [rtw89_pci (HASH:4c83 2)]\\n   __local_bh_enable_ip+0xeb/0x120 kernel/softirq.c:499 kernel/softirq.c:423\\n   \u003c/IRQ\u003e\\n   \u003cTASK\u003e\\n   rtw89_pci_interrupt_threadfn+0xf8/0x350 [rtw89_pci (HASH:4c83 2)]\\n   ? irq_thread+0xa7/0x340 kernel/irq/manage.c:0\\n   irq_thread+0x177/0x340 kernel/irq/manage.c:1205 kernel/irq/manage.c:1314\\n   ? thaw_kernel_threads+0xb0/0xb0 kernel/irq/manage.c:1202\\n   ? irq_forced_thread_fn+0x80/0x80 kernel/irq/manage.c:1220\\n   kthread+0xea/0x110 kernel/kthread.c:376\\n   ? synchronize_irq+0x1a0/0x1a0 kernel/irq/manage.c:1287\\n   ? kthread_associate_blkcg+0x80/0x80 kernel/kthread.c:331\\n   ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295\\n   \u003c/TASK\u003e\\n\\nTo prevent crash, validate rpp_info.seq before using.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/net/wireless/realtek/rtw89/pci.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"e3ec7017f6a20d12ddd9fe23d345ebb7b8c104dd\",\"lessThan\":\"ef7fa19809b2d892d45da53f90ac698d13c367fd\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"e3ec7017f6a20d12ddd9fe23d345ebb7b8c104dd\",\"lessThan\":\"b342dd13aedccb0dd27365f6cc63a262f42394ce\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"e3ec7017f6a20d12ddd9fe23d345ebb7b8c104dd\",\"lessThan\":\"957eda596c7665f2966970fd1dcc35fe299b38e8\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/net/wireless/realtek/rtw89/pci.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.16\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.16\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.16\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.19.6\",\"lessThanOrEqual\":\"6.19.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.0\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"ADJACENT_NETWORK\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.6,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-476\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.18.16\",\"matchCriteriaId\":\"29ED84C1-BD97-40F4-B3BE-7ACD9AA05DC4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.19\",\"versionEndExcluding\":\"6.19.6\",\"matchCriteriaId\":\"373EEEDA-FAA1-4FB4-B6ED-DB4DD99DBE67\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/957eda596c7665f2966970fd1dcc35fe299b38e8\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/b342dd13aedccb0dd27365f6cc63a262f42394ce\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/ef7fa19809b2d892d45da53f90ac698d13c367fd\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-07-02T12:50:41+00:00",
      "cve": "CVE-2026-43213",
      "id": "CVE-2026-43213",
      "initial_release_date": "2026-05-06T00:00:00+00:00",
      "product_status:known_affected": "232",
      "product_status:known_not_affected": "42",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: wifi: rtw89: pci: validate sequence number of TX release report",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-43213.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.