CVE-2026-74412

Received Received - Intake

Type Confusion in Linux Kernel RTW88 WiFi Driver

Publication date: 2026-08-15

Last updated on: 2026-08-17

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: wifi: rtw88: fix wrong pci_get_drvdata type in AER handlers rtw88 stores an ieee80211_hw pointer via pci_set_drvdata() at probe time, but io_error_detected() and io_resume() retrieve it as a net_device pointer. This causes netif_device_detach/attach to operate on an ieee80211_hw struct, reading and writing at wrong offsets. Use ieee80211_stop_queues/wake_queues instead, consistent with every other queue stop/start path in the driver.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-17

Generated

2026-09-04

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-74412

EUVD

EUVD-2026-59559

Affected Vendors & Products

Vendor	Product	Version / Range
linux_kernel	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability affects the Linux kernel's wifi driver rtw88. It involves a type mismatch where a pointer stored as ieee80211_hw is incorrectly retrieved as net_device in PCI AER handlers. This causes incorrect operations on the ieee80211_hw struct, leading to potential memory corruption or system instability.

Detection Guidance

This vulnerability affects the Linux kernel's rtw88 WiFi driver and involves incorrect pointer handling in PCI AER handlers. Detection requires checking kernel logs for PCI AER errors related to the rtw88 driver and verifying the driver version. Use commands like dmesg | grep -i aer or lspci -v to inspect PCI devices and driver details.

Impact Analysis

If exploited, this flaw could cause system crashes, data corruption, or unexpected behavior in wireless network operations. Users might experience Wi-Fi disconnections, performance issues, or kernel panics, depending on the system configuration and usage.

Compliance Impact

This vulnerability does not directly affect compliance with standards like GDPR or HIPAA. It is a Linux kernel driver issue related to PCI error handling in the rtw88 WiFi driver, which could cause system instability or crashes but does not involve data privacy or security controls relevant to these regulations.

Mitigation Strategies

Update the Linux kernel to a patched version that includes the fix for this vulnerability. If immediate patching is not possible, disable the rtw88 driver or the affected WiFi hardware to prevent exploitation. Monitor vendor advisories for kernel updates.

Hi! I’m here to help you understand CVE-2026-74412. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70