GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-74412 (GCVE-0-2026-74412)

Vulnerability from cvelistv5 – Published: 2026-08-15 05:59 – Updated: 2026-08-17 05:46
VLAI
Title
wifi: rtw88: fix wrong pci_get_drvdata type in AER handlers
Summary
In the Linux kernel, the following vulnerability has been resolved: wifi: rtw88: fix wrong pci_get_drvdata type in AER handlers rtw88 stores an ieee80211_hw pointer via pci_set_drvdata() at probe time, but io_error_detected() and io_resume() retrieve it as a net_device pointer. This causes netif_device_detach/attach to operate on an ieee80211_hw struct, reading and writing at wrong offsets. Use ieee80211_stop_queues/wake_queues instead, consistent with every other queue stop/start path in the driver.
Severity
8.8 (High)
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: cdb82c80b9349ed1d9ce6b49856128e04f4effc9 , < 1ef3d1338d94ec41f58fbfb6ba7742a27ea61d89 (git)
Affected: cdb82c80b9349ed1d9ce6b49856128e04f4effc9 , < d7920797f721f944861f3c48ffb2b73f84b631fe (git)
Affected: cdb82c80b9349ed1d9ce6b49856128e04f4effc9 , < 706183dbef4a79d120d4e928f693bea50df496f8 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.17
Unaffected: 0 , < 6.17 (semver)
Unaffected: 6.18.40 , ≤ 6.18.* (semver)
Unaffected: 7.1.5 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wireless/realtek/rtw88/pci.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "1ef3d1338d94ec41f58fbfb6ba7742a27ea61d89",
              "status": "affected",
              "version": "cdb82c80b9349ed1d9ce6b49856128e04f4effc9",
              "versionType": "git"
            },
            {
              "lessThan": "d7920797f721f944861f3c48ffb2b73f84b631fe",
              "status": "affected",
              "version": "cdb82c80b9349ed1d9ce6b49856128e04f4effc9",
              "versionType": "git"
            },
            {
              "lessThan": "706183dbef4a79d120d4e928f693bea50df496f8",
              "status": "affected",
              "version": "cdb82c80b9349ed1d9ce6b49856128e04f4effc9",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wireless/realtek/rtw88/pci.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.17"
            },
            {
              "lessThan": "6.17",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.40",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.40",
                  "versionStartIncluding": "6.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "6.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.17",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: rtw88: fix wrong pci_get_drvdata type in AER handlers\n\nrtw88 stores an ieee80211_hw pointer via pci_set_drvdata() at probe\ntime, but io_error_detected() and io_resume() retrieve it as a\nnet_device pointer.  This causes netif_device_detach/attach to\noperate on an ieee80211_hw struct, reading and writing at wrong\noffsets.\n\nUse ieee80211_stop_queues/wake_queues instead, consistent with\nevery other queue stop/start path in the driver."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:A - The vulnerable rtw88 PCIe WiFi AER handlers run when the adapter\u0027s PCIe link reports non-fatal/fatal errors; on laptops/desktops with these common adapters in public wireless environments, an adjacent attacker can plausibly induce such link faults via malicious wireless traffic stressing the radio-PCIe interface.\nAC:L - Once PCIe AER recovery is invoked on the rtw88 device, the type confusion deterministically misinterprets ieee80211_hw as net_device and corrupts memory via netif_device_detach/attach; no further race or layout conditions beyond triggering AER recovery are required.\nPR:N - Exploitation does not require local OS privileges or kernel capabilities; an adjacent wireless attacker targeting the victim\u0027s rtw88 PCIe WiFi adapter can trigger the faulty AER recovery path without authenticating to or having an account on the victim system.\nUI:N - Triggering PCIe error recovery and the resulting memory corruption does not require any action by the victim user beyond the system operating with the affected rtw88 WiFi hardware present and in use.\nS:U - The type confusion corrupts kernel memory within the same kernel security authority; it does not cross VM, container, or IOMMU boundaries to impact separate security domains.\nC:H - Casting ieee80211_hw to net_device causes netif_device_detach/attach to read fields at incorrect offsets (state, flags, queue metadata), constituting type confusion that can disclose adjacent kernel memory and is rated High per kernel CVSS guidance for type confusion.\nI:H - The bug performs atomic bit clears/sets and netif queue stop/wake operations on memory interpreted as net_device fields but actually within ieee80211_hw, enabling out-of-bounds writes and exploitable memory corruption consistent with High integrity impact.\nA:H - Misinterpreting ieee80211_hw as net_device leads netif_tx_stop_all_queues and netdev_watchdog_up to dereference garbage queue pointers and locks, causing kernel oops/panic during AER recovery and qualifying as High availability impact."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T05:46:55.998Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/1ef3d1338d94ec41f58fbfb6ba7742a27ea61d89"
        },
        {
          "url": "https://git.kernel.org/stable/c/d7920797f721f944861f3c48ffb2b73f84b631fe"
        },
        {
          "url": "https://git.kernel.org/stable/c/706183dbef4a79d120d4e928f693bea50df496f8"
        }
      ],
      "title": "wifi: rtw88: fix wrong pci_get_drvdata type in AER handlers",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74412",
    "datePublished": "2026-08-15T05:59:19.354Z",
    "dateReserved": "2026-08-15T05:44:03.893Z",
    "dateUpdated": "2026-08-17T05:46:55.998Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-74412",
      "date": "2026-09-04",
      "epss": "0.0024",
      "percentile": "0.14923"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-74412\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-08-15T06:22:43.317\",\"lastModified\":\"2026-08-17T06:19:36.680\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nwifi: rtw88: fix wrong pci_get_drvdata type in AER handlers\\n\\nrtw88 stores an ieee80211_hw pointer via pci_set_drvdata() at probe\\ntime, but io_error_detected() and io_resume() retrieve it as a\\nnet_device pointer.  This causes netif_device_detach/attach to\\noperate on an ieee80211_hw struct, reading and writing at wrong\\noffsets.\\n\\nUse ieee80211_stop_queues/wake_queues instead, consistent with\\nevery other queue stop/start path in the driver.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/net/wireless/realtek/rtw88/pci.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"cdb82c80b9349ed1d9ce6b49856128e04f4effc9\",\"lessThan\":\"1ef3d1338d94ec41f58fbfb6ba7742a27ea61d89\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"cdb82c80b9349ed1d9ce6b49856128e04f4effc9\",\"lessThan\":\"d7920797f721f944861f3c48ffb2b73f84b631fe\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"cdb82c80b9349ed1d9ce6b49856128e04f4effc9\",\"lessThan\":\"706183dbef4a79d120d4e928f693bea50df496f8\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/net/wireless/realtek/rtw88/pci.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.17\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.17\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.40\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1.5\",\"lessThanOrEqual\":\"7.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":8.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"ADJACENT_NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.8,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/1ef3d1338d94ec41f58fbfb6ba7742a27ea61d89\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/706183dbef4a79d120d4e928f693bea50df496f8\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/d7920797f721f944861f3c48ffb2b73f84b631fe\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-20T22:19:09+00:00",
      "cve": "CVE-2026-74412",
      "id": "CVE-2026-74412",
      "initial_release_date": "2026-08-15T00:00:00+00:00",
      "product_status:known_affected": "184",
      "product_status:known_not_affected": "90",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: wifi: rtw88: fix wrong pci_get_drvdata type in AER handlers",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74412.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.