CVE-2026-74410

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-74410", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-08-15T05:44:03.892Z", "datePublished": "2026-08-15T05:59:18.039Z", "dateUpdated": "2026-10-16T19:05:43.968Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-17T05:46:53.802Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: rtw88: fix OOB read from firmware RX descriptor exceeding DMA buffer\n\nIn rtw_pci_rx_napi(), new_len is computed as the sum of pkt_len (14-bit\ndescriptor field, max 16383) and pkt_offset (drv_info_sz + shift, both\nfirmware-controlled). The result can exceed RTK_PCI_RX_BUF_SIZE (11478),\ncausing an out-of-bounds read from the pre-allocated DMA buffer when\nskb_put_data copies new_len bytes. The USB transport already validates\nthis (rtw_usb_rx_data_put checks against RTW_USB_MAX_RECVBUF_SZ); the\nPCIe path does not.\n\nAdd a check that new_len does not exceed the DMA buffer size."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H", "baseScore": 8.1, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:A - The bug is in rtw_pci_rx_napi() on the rtw88 PCIe WiFi RX path, reached when firmware DMAs received 802.11 frames and raises IMR_ROK; exploitation requires transmitting crafted or maximum-size WiFi frames within radio range, which is an adjacent wireless attack per kernel CVSS guidance.\nAC:L - An adjacent attacker can reliably trigger the bug by sending WiFi traffic that causes firmware to populate RX descriptors with pkt_len (up to 16383) plus pkt_offset (drv_info_sz+shift); sums above RTK_PCI_RX_BUF_SIZE (11478) are possible even with max VHT MPDUs (~11454 bytes), and the PCIe path lacked the USB driver's length validation.\nPR:N - No local account, capabilities, or namespace privileges on the victim are required; any unauthenticated attacker in WiFi range can cause the device to receive frames and invoke the driver RX interrupt/NAPI handler without victim credentials or association to the attacker's network.\nUI:N - Exploitation requires only that the rtw88 PCIe interface is active and receiving frames, which is the default on laptops, desktops, and many embedded systems with WiFi enabled; no additional victim actions such as opening files or mounting filesystems are needed.\nS:U - The vulnerability is confined to kernel memory accessed by the rtw88 host driver during RX processing on the same system; it does not cross a VM, container, or IOMMU security boundary to impact a separate security authority.\nC:H - skb_put_data() copies new_len bytes from a 11478-byte DMA RX skb without bounds checking, performing an out-of-bounds kernel heap read of up to thousands of bytes of adjacent slab memory that may contain pointers, keys, or other sensitive data subsequently embedded in the RX skb.\nI:N - The flaw is an out-of-bounds read via memcpy from the undersized RX buffer into a separately allocated skb; it does not directly overwrite kernel memory or provide an arbitrary write primitive, though leaked data could aid separate exploitation.\nA:H - Reading substantially beyond the mapped 11478-byte RX DMA buffer can access unmapped pages or slab redzones and provoke a kernel fault/oops during interrupt/NAPI processing, and repeated malicious frames can disrupt WiFi RX availability on affected rtw88 PCIe devices."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/wireless/realtek/rtw88/pci.c"], "versions": [{"version": "e3037485c68ec1a299ff41160d8fedbd4abc29b9", "lessThan": "913bd7d3d3d842b5c1d2b908a0201efa8fc79793", "status": "affected", "versionType": "git"}, {"version": "e3037485c68ec1a299ff41160d8fedbd4abc29b9", "lessThan": "45abc14ab3f15da7d689f1a8809c1a01240a94d9", "status": "affected", "versionType": "git"}, {"version": "e3037485c68ec1a299ff41160d8fedbd4abc29b9", "lessThan": "08193e733e5d4790e6c937af86d78793b02709be", "status": "affected", "versionType": "git"}, {"version": "e3037485c68ec1a299ff41160d8fedbd4abc29b9", "lessThan": "6a3c384393d3f0b41669ed5a2e88744aad9d87c8", "status": "affected", "versionType": "git"}, {"version": "e3037485c68ec1a299ff41160d8fedbd4abc29b9", "lessThan": "26c183a86ea4dd1f2ff90c6f783649e7f5722a10", "status": "affected", "versionType": "git"}, {"version": "e3037485c68ec1a299ff41160d8fedbd4abc29b9", "lessThan": "01155ded5d4dad61840a9a3c33ab56778ef1f100", "status": "affected", "versionType": "git"}, {"version": "e3037485c68ec1a299ff41160d8fedbd4abc29b9", "lessThan": "1554fa522f16ec7c5c342ad33fe734eeb6eb2452", "status": "affected", "versionType": "git"}, {"version": "e3037485c68ec1a299ff41160d8fedbd4abc29b9", "lessThan": "6e76e9ed273dfb4b3333a5ebbb94958cc5752ab6", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/wireless/realtek/rtw88/pci.c"], "versions": [{"version": "5.2", "status": "affected"}, {"version": "0", "lessThan": "5.2", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.261", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.212", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.178", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.145", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.97", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.40", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.5", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.2", "versionEndExcluding": "5.10.261"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.2", "versionEndExcluding": "5.15.212"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.2", "versionEndExcluding": "6.1.178"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.2", "versionEndExcluding": "6.6.145"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.2", "versionEndExcluding": "6.12.97"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.2", "versionEndExcluding": "6.18.40"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.2", "versionEndExcluding": "7.1.5"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.2", "versionEndExcluding": "7.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/913bd7d3d3d842b5c1d2b908a0201efa8fc79793"}, {"url": "https://git.kernel.org/stable/c/45abc14ab3f15da7d689f1a8809c1a01240a94d9"}, {"url": "https://git.kernel.org/stable/c/08193e733e5d4790e6c937af86d78793b02709be"}, {"url": "https://git.kernel.org/stable/c/6a3c384393d3f0b41669ed5a2e88744aad9d87c8"}, {"url": "https://git.kernel.org/stable/c/26c183a86ea4dd1f2ff90c6f783649e7f5722a10"}, {"url": "https://git.kernel.org/stable/c/01155ded5d4dad61840a9a3c33ab56778ef1f100"}, {"url": "https://git.kernel.org/stable/c/1554fa522f16ec7c5c342ad33fe734eeb6eb2452"}, {"url": "https://git.kernel.org/stable/c/6e76e9ed273dfb4b3333a5ebbb94958cc5752ab6"}], "title": "wifi: rtw88: fix OOB read from firmware RX descriptor exceeding DMA buffer", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-74410", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-16T18:56:04.346060Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-16T19:05:43.968Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-74410", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-16T18:56:04.346060Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-16T18:56:05.397Z"}}], "cna": {"title": "wifi: rtw88: fix OOB read from firmware RX descriptor exceeding DMA buffer", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 8.1, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H"}, "scenarios": [{"lang": "en", "value": "AV:A - The bug is in rtw_pci_rx_napi() on the rtw88 PCIe WiFi RX path, reached when firmware DMAs received 802.11 frames and raises IMR_ROK; exploitation requires transmitting crafted or maximum-size WiFi frames within radio range, which is an adjacent wireless attack per kernel CVSS guidance.\nAC:L - An adjacent attacker can reliably trigger the bug by sending WiFi traffic that causes firmware to populate RX descriptors with pkt_len (up to 16383) plus pkt_offset (drv_info_sz+shift); sums above RTK_PCI_RX_BUF_SIZE (11478) are possible even with max VHT MPDUs (~11454 bytes), and the PCIe path lacked the USB driver's length validation.\nPR:N - No local account, capabilities, or namespace privileges on the victim are required; any unauthenticated attacker in WiFi range can cause the device to receive frames and invoke the driver RX interrupt/NAPI handler without victim credentials or association to the attacker's network.\nUI:N - Exploitation requires only that the rtw88 PCIe interface is active and receiving frames, which is the default on laptops, desktops, and many embedded systems with WiFi enabled; no additional victim actions such as opening files or mounting filesystems are needed.\nS:U - The vulnerability is confined to kernel memory accessed by the rtw88 host driver during RX processing on the same system; it does not cross a VM, container, or IOMMU security boundary to impact a separate security authority.\nC:H - skb_put_data() copies new_len bytes from a 11478-byte DMA RX skb without bounds checking, performing an out-of-bounds kernel heap read of up to thousands of bytes of adjacent slab memory that may contain pointers, keys, or other sensitive data subsequently embedded in the RX skb.\nI:N - The flaw is an out-of-bounds read via memcpy from the undersized RX buffer into a separately allocated skb; it does not directly overwrite kernel memory or provide an arbitrary write primitive, though leaked data could aid separate exploitation.\nA:H - Reading substantially beyond the mapped 11478-byte RX DMA buffer can access unmapped pages or slab redzones and provoke a kernel fault/oops during interrupt/NAPI processing, and repeated malicious frames can disrupt WiFi RX availability on affected rtw88 PCIe devices."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "e3037485c68ec1a299ff41160d8fedbd4abc29b9", "lessThan": "913bd7d3d3d842b5c1d2b908a0201efa8fc79793", "versionType": "git"}, {"status": "affected", "version": "e3037485c68ec1a299ff41160d8fedbd4abc29b9", "lessThan": "45abc14ab3f15da7d689f1a8809c1a01240a94d9", "versionType": "git"}, {"status": "affected", "version": "e3037485c68ec1a299ff41160d8fedbd4abc29b9", "lessThan": "08193e733e5d4790e6c937af86d78793b02709be", "versionType": "git"}, {"status": "affected", "version": "e3037485c68ec1a299ff41160d8fedbd4abc29b9", "lessThan": "6a3c384393d3f0b41669ed5a2e88744aad9d87c8", "versionType": "git"}, {"status": "affected", "version": "e3037485c68ec1a299ff41160d8fedbd4abc29b9", "lessThan": "26c183a86ea4dd1f2ff90c6f783649e7f5722a10", "versionType": "git"}, {"status": "affected", "version": "e3037485c68ec1a299ff41160d8fedbd4abc29b9", "lessThan": "01155ded5d4dad61840a9a3c33ab56778ef1f100", "versionType": "git"}, {"status": "affected", "version": "e3037485c68ec1a299ff41160d8fedbd4abc29b9", "lessThan": "1554fa522f16ec7c5c342ad33fe734eeb6eb2452", "versionType": "git"}, {"status": "affected", "version": "e3037485c68ec1a299ff41160d8fedbd4abc29b9", "lessThan": "6e76e9ed273dfb4b3333a5ebbb94958cc5752ab6", "versionType": "git"}], "programFiles": ["drivers/net/wireless/realtek/rtw88/pci.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "5.2"}, {"status": "unaffected", "version": "0", "lessThan": "5.2", "versionType": "semver"}, {"status": "unaffected", "version": "5.10.261", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.15.212", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.178", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.145", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.97", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.40", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "7.1.5", "versionType": "semver", "lessThanOrEqual": "7.1.*"}, {"status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/net/wireless/realtek/rtw88/pci.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/913bd7d3d3d842b5c1d2b908a0201efa8fc79793"}, {"url": "https://git.kernel.org/stable/c/45abc14ab3f15da7d689f1a8809c1a01240a94d9"}, {"url": "https://git.kernel.org/stable/c/08193e733e5d4790e6c937af86d78793b02709be"}, {"url": "https://git.kernel.org/stable/c/6a3c384393d3f0b41669ed5a2e88744aad9d87c8"}, {"url": "https://git.kernel.org/stable/c/26c183a86ea4dd1f2ff90c6f783649e7f5722a10"}, {"url": "https://git.kernel.org/stable/c/01155ded5d4dad61840a9a3c33ab56778ef1f100"}, {"url": "https://git.kernel.org/stable/c/1554fa522f16ec7c5c342ad33fe734eeb6eb2452"}, {"url": "https://git.kernel.org/stable/c/6e76e9ed273dfb4b3333a5ebbb94958cc5752ab6"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: rtw88: fix OOB read from firmware RX descriptor exceeding DMA buffer\n\nIn rtw_pci_rx_napi(), new_len is computed as the sum of pkt_len (14-bit\ndescriptor field, max 16383) and pkt_offset (drv_info_sz + shift, both\nfirmware-controlled). The result can exceed RTK_PCI_RX_BUF_SIZE (11478),\ncausing an out-of-bounds read from the pre-allocated DMA buffer when\nskb_put_data copies new_len bytes. The USB transport already validates\nthis (rtw_usb_rx_data_put checks against RTW_USB_MAX_RECVBUF_SZ); the\nPCIe path does not.\n\nAdd a check that new_len does not exceed the DMA buffer size."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.10.261", "versionStartIncluding": "5.2"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.15.212", "versionStartIncluding": "5.2"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.178", "versionStartIncluding": "5.2"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.145", "versionStartIncluding": "5.2"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.97", "versionStartIncluding": "5.2"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.18.40", "versionStartIncluding": "5.2"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.1.5", "versionStartIncluding": "5.2"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.2", "versionStartIncluding": "5.2"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-17T05:46:53.802Z"}}}, "cveMetadata": {"cveId": "CVE-2026-74410", "state": "PUBLISHED", "dateUpdated": "2026-10-16T19:05:43.968Z", "dateReserved": "2026-08-15T05:44:03.892Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2026-08-15T05:59:18.039Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/net/wireless/realtek/rtw88/pci.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "913bd7d3d3d842b5c1d2b908a0201efa8fc79793", "status": "affected", "version": "e3037485c68ec1a299ff41160d8fedbd4abc29b9", "versionType": "git"}, {"lessThan": "45abc14ab3f15da7d689f1a8809c1a01240a94d9", "status": "affected", "version": "e3037485c68ec1a299ff41160d8fedbd4abc29b9", "versionType": "git"}, {"lessThan": "08193e733e5d4790e6c937af86d78793b02709be", "status": "affected", "version": "e3037485c68ec1a299ff41160d8fedbd4abc29b9", "versionType": "git"}, {"lessThan": "6a3c384393d3f0b41669ed5a2e88744aad9d87c8", "status": "affected", "version": "e3037485c68ec1a299ff41160d8fedbd4abc29b9", "versionType": "git"}, {"lessThan": "26c183a86ea4dd1f2ff90c6f783649e7f5722a10", "status": "affected", "version": "e3037485c68ec1a299ff41160d8fedbd4abc29b9", "versionType": "git"}, {"lessThan": "01155ded5d4dad61840a9a3c33ab56778ef1f100", "status": "affected", "version": "e3037485c68ec1a299ff41160d8fedbd4abc29b9", "versionType": "git"}, {"lessThan": "1554fa522f16ec7c5c342ad33fe734eeb6eb2452", "status": "affected", "version": "e3037485c68ec1a299ff41160d8fedbd4abc29b9", "versionType": "git"}, {"lessThan": "6e76e9ed273dfb4b3333a5ebbb94958cc5752ab6", "status": "affected", "version": "e3037485c68ec1a299ff41160d8fedbd4abc29b9", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/net/wireless/realtek/rtw88/pci.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.2"}, {"lessThan": "5.2", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.261", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.212", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.178", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.145", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.97", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.40", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.5", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: rtw88: fix OOB read from firmware RX descriptor exceeding DMA buffer\n\nIn rtw_pci_rx_napi(), new_len is computed as the sum of pkt_len (14-bit\ndescriptor field, max 16383) and pkt_offset (drv_info_sz + shift, both\nfirmware-controlled). The result can exceed RTK_PCI_RX_BUF_SIZE (11478),\ncausing an out-of-bounds read from the pre-allocated DMA buffer when\nskb_put_data copies new_len bytes. The USB transport already validates\nthis (rtw_usb_rx_data_put checks against RTW_USB_MAX_RECVBUF_SZ); the\nPCIe path does not.\n\nAdd a check that new_len does not exceed the DMA buffer size."}], "id": "CVE-2026-74410", "lastModified": "2026-10-16T20:17:26.550", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.2, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-74410", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-10-16T18:56:04.346060Z", "version": "2.0.3"}}]}, "published": "2026-08-15T06:22:43.043", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/01155ded5d4dad61840a9a3c33ab56778ef1f100"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/08193e733e5d4790e6c937af86d78793b02709be"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/1554fa522f16ec7c5c342ad33fe734eeb6eb2452"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/26c183a86ea4dd1f2ff90c6f783649e7f5722a10"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/45abc14ab3f15da7d689f1a8809c1a01240a94d9"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/6a3c384393d3f0b41669ed5a2e88744aad9d87c8"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/6e76e9ed273dfb4b3333a5ebbb94958cc5752ab6"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/913bd7d3d3d842b5c1d2b908a0201efa8fc79793"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: wifi: rtw88: fix OOB read from firmware RX descriptor exceeding DMA buffer", "id": "2516859", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2516859"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-125", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nwifi: rtw88: fix OOB read from firmware RX descriptor exceeding DMA buffer\nIn rtw_pci_rx_napi(), new_len is computed as the sum of pkt_len (14-bit\ndescriptor field, max 16383) and pkt_offset (drv_info_sz + shift, both\nfirmware-controlled). The result can exceed RTK_PCI_RX_BUF_SIZE (11478),\ncausing an out-of-bounds read from the pre-allocated DMA buffer when\nskb_put_data copies new_len bytes. The USB transport already validates\nthis (rtw_usb_rx_data_put checks against RTW_USB_MAX_RECVBUF_SZ); the\nPCIe path does not.\nAdd a check that new_len does not exceed the DMA buffer size.", "A flaw was found in the Linux kernel's rtw88 wifi driver. An attacker able to control firmware RX descriptors could cause an out-of-bounds read from the pre-allocated Direct Memory Access (DMA) buffer. This occurs because the new_len calculation in the rtw_pci_rx_napi() function does not properly validate the size of incoming data against the buffer."], "name": "CVE-2026-74410", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-08-15T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-74410\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-74410\nhttps://lore.kernel.org/linux-cve-announce/2026081510-CVE-2026-74410-fb98@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[e3037485c68ec1a299ff41160d8fedbd4abc29b9,913bd7d3d3d842b5c1d2b908a0201efa8fc79793)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[e3037485c68ec1a299ff41160d8fedbd4abc29b9,45abc14ab3f15da7d689f1a8809c1a01240a94d9)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[e3037485c68ec1a299ff41160d8fedbd4abc29b9,08193e733e5d4790e6c937af86d78793b02709be)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[e3037485c68ec1a299ff41160d8fedbd4abc29b9,6a3c384393d3f0b41669ed5a2e88744aad9d87c8)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[e3037485c68ec1a299ff41160d8fedbd4abc29b9,26c183a86ea4dd1f2ff90c6f783649e7f5722a10)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[e3037485c68ec1a299ff41160d8fedbd4abc29b9,01155ded5d4dad61840a9a3c33ab56778ef1f100)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[e3037485c68ec1a299ff41160d8fedbd4abc29b9,1554fa522f16ec7c5c342ad33fe734eeb6eb2452)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[e3037485c68ec1a299ff41160d8fedbd4abc29b9,6e76e9ed273dfb4b3333a5ebbb94958cc5752ab6)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "5.2"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,5.2)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[5.10.261,5.11.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[5.15.212,5.16.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.1.178,6.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.145,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.97,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.40,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.1.5,7.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-08-15T14:00:08.920988+00:00", "updated": "2026-08-22T00:30:16.948213+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}