CVE-2026-74409
Received Received - Intake

Bounds Check Bypass in Realtek RTL89 WiFi Driver

Publication date: 2026-08-15

Last updated on: 2026-08-15

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: wifi: rtw89: add bounds check on firmware mac_id in link lookup The mac_id field in RX descriptors is 8 bits wide (0-255), but assoc_link_on_macid[] has only RTW89_MAX_MAC_ID_NUM (128) entries. While the driver currently assigns mac_id values below 128, the descriptor value comes from firmware and is not validated before use as an array index. Add a defensive bounds check in rtw89_assoc_link_rcu_dereference() to guard against out-of-range firmware values.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-15
Last Modified
2026-08-15
Generated
2026-08-15
AI Q&A
2026-08-15
EPSS Evaluated
N/A
NVD
CVE-2026-74409
EUVD
EUVD-2026-59556

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a buffer overflow vulnerability in the Linux kernel's wifi driver for Realtek RTL89xx devices. The issue occurs because the mac_id field in received wifi packets is 8 bits wide (0-255) but the driver's lookup table only has 128 entries. Firmware can send a mac_id value that exceeds this limit, causing the driver to access memory outside the allocated array.

Detection Guidance

This vulnerability involves a bounds check issue in the Linux kernel's wifi driver rtw89. Detection requires checking if your system uses the affected driver version. Inspect loaded kernel modules with lsmod | grep rtw89. Check kernel logs for related errors with dmesg | grep rtw89. Verify kernel version with uname -r to ensure it includes the fix.

Impact Analysis

An attacker within wifi range could potentially crash the system or execute arbitrary code by sending specially crafted wifi packets. This could lead to denial of service or unauthorized access to the affected device.

Mitigation Strategies

Immediately update your Linux kernel to a patched version that includes the fix for this CVE. If using a distribution kernel, apply available security updates via your package manager. If using a custom kernel, recompile with the patch applied. Monitor vendor advisories for specific kernel versions addressing this issue.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-74409. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart