CVE-2026-43213

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-43213", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-05-01T14:12:55.993Z", "datePublished": "2026-05-06T11:28:15.998Z", "dateUpdated": "2026-10-30T12:25:10.203Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-30T12:25:10.203Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: rtw89: pci: validate sequence number of TX release report\n\nHardware rarely reports abnormal sequence number in TX release report,\nwhich will access out-of-bounds of wd_ring->pages array, causing NULL\npointer dereference.\n\n BUG: kernel NULL pointer dereference, address: 0000000000000000\n #PF: supervisor read access in kernel mode\n #PF: error_code(0x0000) - not-present page\n PGD 0 P4D 0\n Oops: 0000 [#1] PREEMPT SMP NOPTI\n CPU: 1 PID: 1085 Comm: irq/129-rtw89_p Tainted: G S U\n 6.1.145-17510-g2f3369c91536 #1 (HASH:69e8 1)\n Call Trace:\n <IRQ>\n rtw89_pci_release_tx+0x18f/0x300 [rtw89_pci (HASH:4c83 2)]\n rtw89_pci_napi_poll+0xc2/0x190 [rtw89_pci (HASH:4c83 2)]\n net_rx_action+0xfc/0x460 net/core/dev.c:6578 net/core/dev.c:6645 net/core/dev.c:6759\n handle_softirqs+0xbe/0x290 kernel/softirq.c:601\n ? rtw89_pci_interrupt_threadfn+0xc5/0x350 [rtw89_pci (HASH:4c83 2)]\n __local_bh_enable_ip+0xeb/0x120 kernel/softirq.c:499 kernel/softirq.c:423\n </IRQ>\n <TASK>\n rtw89_pci_interrupt_threadfn+0xf8/0x350 [rtw89_pci (HASH:4c83 2)]\n ? irq_thread+0xa7/0x340 kernel/irq/manage.c:0\n irq_thread+0x177/0x340 kernel/irq/manage.c:1205 kernel/irq/manage.c:1314\n ? thaw_kernel_threads+0xb0/0xb0 kernel/irq/manage.c:1202\n ? irq_forced_thread_fn+0x80/0x80 kernel/irq/manage.c:1220\n kthread+0xea/0x110 kernel/kthread.c:376\n ? synchronize_irq+0x1a0/0x1a0 kernel/irq/manage.c:1287\n ? kthread_associate_blkcg+0x80/0x80 kernel/kthread.c:331\n ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295\n </TASK>\n\nTo prevent crash, validate rpp_info.seq before using."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.5, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:A - The vulnerable path is the rtw89 PCI WiFi TX release-report path reached from the device RPQ interrupt/NAPI handler after wireless transmissions. In AP or client deployments, an unauthenticated radio-range attacker can plausibly induce repeated TX completions by injecting or eliciting WiFi traffic.\nAC:H - The code path is deterministic once a malformed release report with an out-of-range sequence number is produced. However, the malformed sequence is described as a rare hardware/firmware report and is not directly chosen by the attacker.\nPR:N - In the adjacent WiFi attack scenario, the attacker does not need local accounts, capabilities, or authenticated access to the target host. Radio proximity is sufficient to stimulate the vulnerable TX completion path.\nUI:N - No victim action is required once the affected WiFi interface is active. The vulnerable processing occurs asynchronously in interrupt/NAPI context.\nS:U - The impact remains within the kernel and the affected host. There is no VM escape, IOMMU bypass, or cross-authority boundary change.\nC:H - The invalid 15-bit sequence number indexes past the 512-entry wd_ring->pages array and causes adjacent kernel memory to be interpreted as TX descriptor/list/queue state. Conservatively, this out-of-bounds kernel memory access can expose sensitive kernel memory even though the observed failure is a NULL dereference.\nI:H - The out-of-bounds pseudo-TX descriptor can drive list, skb queue, DMA-unmap, status, and enqueue operations using invalid pointer fields. Conservatively, this kernel memory corruption can permit high-integrity impact.\nA:H - The fix commit documents a kernel NULL pointer dereference and oops in rtw89_pci_release_tx from this bug. A kernel crash or panic is a high availability impact."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/wireless/realtek/rtw89/pci.c"], "versions": [{"version": "e3ec7017f6a20d12ddd9fe23d345ebb7b8c104dd", "lessThan": "973392ea942a8a2981724c2c230972c8eb3cb703", "status": "affected", "versionType": "git"}, {"version": "e3ec7017f6a20d12ddd9fe23d345ebb7b8c104dd", "lessThan": "c0da84e308a0b0b51cd234168a9d84be4a3c5c50", "status": "affected", "versionType": "git"}, {"version": "e3ec7017f6a20d12ddd9fe23d345ebb7b8c104dd", "lessThan": "0fe36044267c3c70d0471d2109c34f805c975154", "status": "affected", "versionType": "git"}, {"version": "e3ec7017f6a20d12ddd9fe23d345ebb7b8c104dd", "lessThan": "ef7fa19809b2d892d45da53f90ac698d13c367fd", "status": "affected", "versionType": "git"}, {"version": "e3ec7017f6a20d12ddd9fe23d345ebb7b8c104dd", "lessThan": "b342dd13aedccb0dd27365f6cc63a262f42394ce", "status": "affected", "versionType": "git"}, {"version": "e3ec7017f6a20d12ddd9fe23d345ebb7b8c104dd", "lessThan": "957eda596c7665f2966970fd1dcc35fe299b38e8", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/wireless/realtek/rtw89/pci.c"], "versions": [{"version": "5.16", "status": "affected"}, {"version": "0", "lessThan": "5.16", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.191", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.160", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.114", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.16", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.19.6", "lessThanOrEqual": "6.19.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.16", "versionEndExcluding": "6.1.191"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.16", "versionEndExcluding": "6.6.160"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.16", "versionEndExcluding": "6.12.114"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.16", "versionEndExcluding": "6.18.16"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.16", "versionEndExcluding": "6.19.6"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.16", "versionEndExcluding": "7.0"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/973392ea942a8a2981724c2c230972c8eb3cb703"}, {"url": "https://git.kernel.org/stable/c/c0da84e308a0b0b51cd234168a9d84be4a3c5c50"}, {"url": "https://git.kernel.org/stable/c/0fe36044267c3c70d0471d2109c34f805c975154"}, {"url": "https://git.kernel.org/stable/c/ef7fa19809b2d892d45da53f90ac698d13c367fd"}, {"url": "https://git.kernel.org/stable/c/b342dd13aedccb0dd27365f6cc63a262f42394ce"}, {"url": "https://git.kernel.org/stable/c/957eda596c7665f2966970fd1dcc35fe299b38e8"}], "title": "wifi: rtw89: pci: validate sequence number of TX release report", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-43213", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-16T15:15:48.810008Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-125", "description": "CWE-125 Out-of-bounds Read"}]}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-19T19:16:24.428Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-43213", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-16T15:15:48.810008Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-125", "description": "CWE-125 Out-of-bounds Read"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-16T15:15:49.368Z"}}], "cna": {"title": "wifi: rtw89: pci: validate sequence number of TX release report", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:A - The vulnerable path is the rtw89 PCI WiFi TX release-report path reached from the device RPQ interrupt/NAPI handler after wireless transmissions. In AP or client deployments, an unauthenticated radio-range attacker can plausibly induce repeated TX completions by injecting or eliciting WiFi traffic.\nAC:H - The code path is deterministic once a malformed release report with an out-of-range sequence number is produced. However, the malformed sequence is described as a rare hardware/firmware report and is not directly chosen by the attacker.\nPR:N - In the adjacent WiFi attack scenario, the attacker does not need local accounts, capabilities, or authenticated access to the target host. Radio proximity is sufficient to stimulate the vulnerable TX completion path.\nUI:N - No victim action is required once the affected WiFi interface is active. The vulnerable processing occurs asynchronously in interrupt/NAPI context.\nS:U - The impact remains within the kernel and the affected host. There is no VM escape, IOMMU bypass, or cross-authority boundary change.\nC:H - The invalid 15-bit sequence number indexes past the 512-entry wd_ring->pages array and causes adjacent kernel memory to be interpreted as TX descriptor/list/queue state. Conservatively, this out-of-bounds kernel memory access can expose sensitive kernel memory even though the observed failure is a NULL dereference.\nI:H - The out-of-bounds pseudo-TX descriptor can drive list, skb queue, DMA-unmap, status, and enqueue operations using invalid pointer fields. Conservatively, this kernel memory corruption can permit high-integrity impact.\nA:H - The fix commit documents a kernel NULL pointer dereference and oops in rtw89_pci_release_tx from this bug. A kernel crash or panic is a high availability impact."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "e3ec7017f6a20d12ddd9fe23d345ebb7b8c104dd", "lessThan": "973392ea942a8a2981724c2c230972c8eb3cb703", "versionType": "git"}, {"status": "affected", "version": "e3ec7017f6a20d12ddd9fe23d345ebb7b8c104dd", "lessThan": "c0da84e308a0b0b51cd234168a9d84be4a3c5c50", "versionType": "git"}, {"status": "affected", "version": "e3ec7017f6a20d12ddd9fe23d345ebb7b8c104dd", "lessThan": "0fe36044267c3c70d0471d2109c34f805c975154", "versionType": "git"}, {"status": "affected", "version": "e3ec7017f6a20d12ddd9fe23d345ebb7b8c104dd", "lessThan": "ef7fa19809b2d892d45da53f90ac698d13c367fd", "versionType": "git"}, {"status": "affected", "version": "e3ec7017f6a20d12ddd9fe23d345ebb7b8c104dd", "lessThan": "b342dd13aedccb0dd27365f6cc63a262f42394ce", "versionType": "git"}, {"status": "affected", "version": "e3ec7017f6a20d12ddd9fe23d345ebb7b8c104dd", "lessThan": "957eda596c7665f2966970fd1dcc35fe299b38e8", "versionType": "git"}], "programFiles": ["drivers/net/wireless/realtek/rtw89/pci.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "5.16"}, {"status": "unaffected", "version": "0", "lessThan": "5.16", "versionType": "semver"}, {"status": "unaffected", "version": "6.1.191", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.160", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.114", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.16", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "6.19.6", "versionType": "semver", "lessThanOrEqual": "6.19.*"}, {"status": "unaffected", "version": "7.0", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/net/wireless/realtek/rtw89/pci.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/973392ea942a8a2981724c2c230972c8eb3cb703"}, {"url": "https://git.kernel.org/stable/c/c0da84e308a0b0b51cd234168a9d84be4a3c5c50"}, {"url": "https://git.kernel.org/stable/c/0fe36044267c3c70d0471d2109c34f805c975154"}, {"url": "https://git.kernel.org/stable/c/ef7fa19809b2d892d45da53f90ac698d13c367fd"}, {"url": "https://git.kernel.org/stable/c/b342dd13aedccb0dd27365f6cc63a262f42394ce"}, {"url": "https://git.kernel.org/stable/c/957eda596c7665f2966970fd1dcc35fe299b38e8"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: rtw89: pci: validate sequence number of TX release report\n\nHardware rarely reports abnormal sequence number in TX release report,\nwhich will access out-of-bounds of wd_ring->pages array, causing NULL\npointer dereference.\n\n BUG: kernel NULL pointer dereference, address: 0000000000000000\n #PF: supervisor read access in kernel mode\n #PF: error_code(0x0000) - not-present page\n PGD 0 P4D 0\n Oops: 0000 [#1] PREEMPT SMP NOPTI\n CPU: 1 PID: 1085 Comm: irq/129-rtw89_p Tainted: G S U\n 6.1.145-17510-g2f3369c91536 #1 (HASH:69e8 1)\n Call Trace:\n <IRQ>\n rtw89_pci_release_tx+0x18f/0x300 [rtw89_pci (HASH:4c83 2)]\n rtw89_pci_napi_poll+0xc2/0x190 [rtw89_pci (HASH:4c83 2)]\n net_rx_action+0xfc/0x460 net/core/dev.c:6578 net/core/dev.c:6645 net/core/dev.c:6759\n handle_softirqs+0xbe/0x290 kernel/softirq.c:601\n ? rtw89_pci_interrupt_threadfn+0xc5/0x350 [rtw89_pci (HASH:4c83 2)]\n __local_bh_enable_ip+0xeb/0x120 kernel/softirq.c:499 kernel/softirq.c:423\n </IRQ>\n <TASK>\n rtw89_pci_interrupt_threadfn+0xf8/0x350 [rtw89_pci (HASH:4c83 2)]\n ? irq_thread+0xa7/0x340 kernel/irq/manage.c:0\n irq_thread+0x177/0x340 kernel/irq/manage.c:1205 kernel/irq/manage.c:1314\n ? thaw_kernel_threads+0xb0/0xb0 kernel/irq/manage.c:1202\n ? irq_forced_thread_fn+0x80/0x80 kernel/irq/manage.c:1220\n kthread+0xea/0x110 kernel/kthread.c:376\n ? synchronize_irq+0x1a0/0x1a0 kernel/irq/manage.c:1287\n ? kthread_associate_blkcg+0x80/0x80 kernel/kthread.c:331\n ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295\n </TASK>\n\nTo prevent crash, validate rpp_info.seq before using."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.191", "versionStartIncluding": "5.16"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.160", "versionStartIncluding": "5.16"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.114", "versionStartIncluding": "5.16"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.18.16", "versionStartIncluding": "5.16"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.19.6", "versionStartIncluding": "5.16"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.0", "versionStartIncluding": "5.16"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-30T12:25:10.203Z"}}}, "cveMetadata": {"cveId": "CVE-2026-43213", "state": "PUBLISHED", "dateUpdated": "2026-10-30T12:25:10.203Z", "dateReserved": "2026-05-01T14:12:55.993Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2026-05-06T11:28:15.998Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/net/wireless/realtek/rtw89/pci.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "973392ea942a8a2981724c2c230972c8eb3cb703", "status": "affected", "version": "e3ec7017f6a20d12ddd9fe23d345ebb7b8c104dd", "versionType": "git"}, {"lessThan": "c0da84e308a0b0b51cd234168a9d84be4a3c5c50", "status": "affected", "version": "e3ec7017f6a20d12ddd9fe23d345ebb7b8c104dd", "versionType": "git"}, {"lessThan": "0fe36044267c3c70d0471d2109c34f805c975154", "status": "affected", "version": "e3ec7017f6a20d12ddd9fe23d345ebb7b8c104dd", "versionType": "git"}, {"lessThan": "ef7fa19809b2d892d45da53f90ac698d13c367fd", "status": "affected", "version": "e3ec7017f6a20d12ddd9fe23d345ebb7b8c104dd", "versionType": "git"}, {"lessThan": "b342dd13aedccb0dd27365f6cc63a262f42394ce", "status": "affected", "version": "e3ec7017f6a20d12ddd9fe23d345ebb7b8c104dd", "versionType": "git"}, {"lessThan": "957eda596c7665f2966970fd1dcc35fe299b38e8", "status": "affected", "version": "e3ec7017f6a20d12ddd9fe23d345ebb7b8c104dd", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/net/wireless/realtek/rtw89/pci.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.16"}, {"lessThan": "5.16", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.191", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.160", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.114", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.16", "versionType": "semver"}, {"lessThanOrEqual": "6.19.*", "status": "unaffected", "version": "6.19.6", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.0", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "29ED84C1-BD97-40F4-B3BE-7ACD9AA05DC4", "versionEndExcluding": "6.18.16", "versionStartIncluding": "5.16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "373EEEDA-FAA1-4FB4-B6ED-DB4DD99DBE67", "versionEndExcluding": "6.19.6", "versionStartIncluding": "6.19", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: rtw89: pci: validate sequence number of TX release report\n\nHardware rarely reports abnormal sequence number in TX release report,\nwhich will access out-of-bounds of wd_ring->pages array, causing NULL\npointer dereference.\n\n BUG: kernel NULL pointer dereference, address: 0000000000000000\n #PF: supervisor read access in kernel mode\n #PF: error_code(0x0000) - not-present page\n PGD 0 P4D 0\n Oops: 0000 [#1] PREEMPT SMP NOPTI\n CPU: 1 PID: 1085 Comm: irq/129-rtw89_p Tainted: G S U\n 6.1.145-17510-g2f3369c91536 #1 (HASH:69e8 1)\n Call Trace:\n <IRQ>\n rtw89_pci_release_tx+0x18f/0x300 [rtw89_pci (HASH:4c83 2)]\n rtw89_pci_napi_poll+0xc2/0x190 [rtw89_pci (HASH:4c83 2)]\n net_rx_action+0xfc/0x460 net/core/dev.c:6578 net/core/dev.c:6645 net/core/dev.c:6759\n handle_softirqs+0xbe/0x290 kernel/softirq.c:601\n ? rtw89_pci_interrupt_threadfn+0xc5/0x350 [rtw89_pci (HASH:4c83 2)]\n __local_bh_enable_ip+0xeb/0x120 kernel/softirq.c:499 kernel/softirq.c:423\n </IRQ>\n <TASK>\n rtw89_pci_interrupt_threadfn+0xf8/0x350 [rtw89_pci (HASH:4c83 2)]\n ? irq_thread+0xa7/0x340 kernel/irq/manage.c:0\n irq_thread+0x177/0x340 kernel/irq/manage.c:1205 kernel/irq/manage.c:1314\n ? thaw_kernel_threads+0xb0/0xb0 kernel/irq/manage.c:1202\n ? irq_forced_thread_fn+0x80/0x80 kernel/irq/manage.c:1220\n kthread+0xea/0x110 kernel/kthread.c:376\n ? synchronize_irq+0x1a0/0x1a0 kernel/irq/manage.c:1287\n ? kthread_associate_blkcg+0x80/0x80 kernel/kthread.c:331\n ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295\n </TASK>\n\nTo prevent crash, validate rpp_info.seq before using."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nwifi: rtw89: pci: validar el n\u00famero de secuencia del informe de liberaci\u00f3n de TX\n\nEl hardware rara vez informa un n\u00famero de secuencia anormal en el informe de liberaci\u00f3n de TX, lo que acceder\u00e1 fuera de los l\u00edmites del array wd_ring -> pages, causando una desreferencia de puntero NULL.\n\n BUG: desreferencia de puntero NULL del kernel, direcci\u00f3n: 0000000000000000\n #PF: acceso de lectura de supervisor en modo kernel\n #PF: error_code(0x 0000) - p\u00e1gina no presente\n PGD 0 P4D 0\n Oops: 0000 [#1] PREEMPT SMP NOPTI\n CPU: 1 PID: 1085 Comm: irq/129-rtw89_p Tainted: G S U\n 6.1.145-17510-g2f3369c91536 #1 (HASH:69e8 1)\n Rastro de Llamada:\n [IRQ]\n rtw89_pci_release_tx+0x18f/0x300 [rtw89_pci (HASH:4c83 2)]\n rtw89_pci_napi_poll+0xc2/0x190 [rtw89_pci (HASH:4c83 2)]\n net_rx_action+0xfc/0x460 net/core/dev.c:6578 net/core/dev.c:6645 net/core/dev.c:6759\n handle_softirqs+0xbe/0x290 kernel/softirq.c:601\n ? rtw89_pci_interrupt_threadfn+0xc5/0x350 [rtw89_pci (HASH:4c83 2)]\n __local_bh_enable_ip+0xeb/0x120 kernel/softirq.c:499 kernel/softirq.c:423\n [/IRQ]\n [TASK]\n rtw89_pci_interrupt_threadfn+0xf8/0x350 [rtw89_pci (HASH:4c83 2)]\n ? irq_thread+0xa7/0x340 kernel/irq/manage.c:0\n irq_thread+0x177/0x340 kernel/irq/manage.c:1205 kernel/irq/manage.c:1314\n ? thaw_kernel_threads+0xb0/0xb0 kernel/irq/manage.c:1202\n ? irq_forced_thread_fn+0x80/0x80 kernel/irq/manage.c:1220\n kthread+0xea/0x110 kernel/kthread.c:376\n ? synchronize_irq+0x1a0/0x1a0 kernel/irq/manage.c:1287\n ? kthread_associate_blkcg+0x80/0x80 kernel/kthread.c:331\n ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295\n [/TASK]\n\nPara evitar un fallo, validar rpp_info.seq antes de usarlo."}], "id": "CVE-2026-43213", "lastModified": "2026-11-11T20:10:00.273", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.6, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-43213", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-16T15:15:48.810008Z", "version": "2.0.3"}}]}, "published": "2026-05-06T12:16:40.803", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/0fe36044267c3c70d0471d2109c34f805c975154"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/957eda596c7665f2966970fd1dcc35fe299b38e8"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/973392ea942a8a2981724c2c230972c8eb3cb703"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/b342dd13aedccb0dd27365f6cc63a262f42394ce"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/c0da84e308a0b0b51cd234168a9d84be4a3c5c50"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/ef7fa19809b2d892d45da53f90ac698d13c367fd"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-476"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-125"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{"bugzilla": {"description": "kernel: wifi: rtw89: pci: validate sequence number of TX release report", "id": "2467221", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467221"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-1285", "details": ["A flaw was found in the Linux kernel's rtw89_pci component. This vulnerability allows an attacker to cause a kernel NULL pointer dereference by sending a specially crafted TX release report with an abnormal sequence number. This can lead to an out-of-bounds memory access, resulting in a system crash and a Denial of Service (DoS)."], "name": "CVE-2026-43213", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-05-06T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-43213\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-43213\nhttps://lore.kernel.org/linux-cve-announce/2026050650-CVE-2026-43213-33d1@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,ef7fa19809b2d892d45da53f90ac698d13c367fd)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,b342dd13aedccb0dd27365f6cc63a262f42394ce)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,957eda596c7665f2966970fd1dcc35fe299b38e8)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.16,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.19.6,6.20.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.0,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-05-06T15:30:06.079759+00:00", "updated": "2026-10-23T02:15:14.701119+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}