CVE-2026-97516

Received Received - Intake

NULL Pointer Dereference in Linux Kernel WiFi Driver

Publication date: 2026-09-24

Last updated on: 2026-10-03

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: wifi: rtw88: Add NULL check for chip->edcca_th in rtw_fw_adaptivity_result() It was recently reported that rtw_fw_adaptivity_result() in fw.c dereferences rtwdev->chip->edcca_th without a NULL check. The issue is that devices with the 8821CE chip don't define edcca_th in their chip info. As a result, when rtw_fw_adaptivity_result() tries to dereference it, the kernel triggers an oops. Add a NULL check for edcca_th before dereferencing it in rtw_fw_adaptivity_result() in fw.c. Placing the check at the function entry avoids logging any garbage values. This change does not address the root cause for this behavior, but it prevents the NULL dereference and the resulting oops while a more permanent solution is developed. Tested on a 8822CE chip which defines edcca_th, so this issue is not present on it, but it still uses this driver and I can verify there are no regressions.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-24

Last Modified

2026-10-03

Generated

2026-10-15

AI Q&A

2026-09-24

EPSS Evaluated

2026-10-13

NVD

CVE-2026-97516

EUVD

EUVD-2026-86114

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a NULL pointer dereference vulnerability in the Linux kernel's wifi driver for Realtek 8821CE chips. The function rtw_fw_adaptivity_result() tries to access a pointer edcca_th without checking if it is NULL first. On devices with 8821CE chips, this pointer is not initialized, causing the kernel to crash with an oops when the function runs.

Detection Guidance

This vulnerability is specific to the Linux kernel's rtw88 WiFi driver and affects devices using the 8821CE chip. Detection requires checking if your system uses the affected driver version and chip. Inspect kernel logs for NULL pointer dereference errors related to rtw_fw_adaptivity_result() or the rtw88 driver.

Impact Analysis

If you use a device with a Realtek 8821CE wifi chip and the affected Linux kernel driver, this vulnerability could cause your system to crash or become unresponsive. The crash occurs when the wifi driver attempts to handle adaptivity results, potentially leading to data loss or requiring a system reboot.

Compliance Impact

This vulnerability does not directly affect compliance with standards like GDPR or HIPAA. It is a Linux kernel issue causing a NULL pointer dereference in the wifi driver for specific hardware (8821CE chip), leading to a kernel oops. No data exposure or privacy implications are described.

Mitigation Strategies

Update your Linux kernel to a patched version that includes the fix for this issue. If an update is not immediately available, consider disabling the rtw88 driver or the affected WiFi chip until a patch is applied. Monitor kernel logs for errors indicating the issue.

Hi! I’m here to help you understand CVE-2026-97516. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70