CVE-2026-74412

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-74412", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-08-15T05:44:03.893Z", "datePublished": "2026-08-15T05:59:19.354Z", "dateUpdated": "2026-10-16T19:05:44.326Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-17T05:46:55.998Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: rtw88: fix wrong pci_get_drvdata type in AER handlers\n\nrtw88 stores an ieee80211_hw pointer via pci_set_drvdata() at probe\ntime, but io_error_detected() and io_resume() retrieve it as a\nnet_device pointer. This causes netif_device_detach/attach to\noperate on an ieee80211_hw struct, reading and writing at wrong\noffsets.\n\nUse ieee80211_stop_queues/wake_queues instead, consistent with\nevery other queue stop/start path in the driver."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:A - The vulnerable rtw88 PCIe WiFi AER handlers run when the adapter's PCIe link reports non-fatal/fatal errors; on laptops/desktops with these common adapters in public wireless environments, an adjacent attacker can plausibly induce such link faults via malicious wireless traffic stressing the radio-PCIe interface.\nAC:L - Once PCIe AER recovery is invoked on the rtw88 device, the type confusion deterministically misinterprets ieee80211_hw as net_device and corrupts memory via netif_device_detach/attach; no further race or layout conditions beyond triggering AER recovery are required.\nPR:N - Exploitation does not require local OS privileges or kernel capabilities; an adjacent wireless attacker targeting the victim's rtw88 PCIe WiFi adapter can trigger the faulty AER recovery path without authenticating to or having an account on the victim system.\nUI:N - Triggering PCIe error recovery and the resulting memory corruption does not require any action by the victim user beyond the system operating with the affected rtw88 WiFi hardware present and in use.\nS:U - The type confusion corrupts kernel memory within the same kernel security authority; it does not cross VM, container, or IOMMU boundaries to impact separate security domains.\nC:H - Casting ieee80211_hw to net_device causes netif_device_detach/attach to read fields at incorrect offsets (state, flags, queue metadata), constituting type confusion that can disclose adjacent kernel memory and is rated High per kernel CVSS guidance for type confusion.\nI:H - The bug performs atomic bit clears/sets and netif queue stop/wake operations on memory interpreted as net_device fields but actually within ieee80211_hw, enabling out-of-bounds writes and exploitable memory corruption consistent with High integrity impact.\nA:H - Misinterpreting ieee80211_hw as net_device leads netif_tx_stop_all_queues and netdev_watchdog_up to dereference garbage queue pointers and locks, causing kernel oops/panic during AER recovery and qualifying as High availability impact."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/wireless/realtek/rtw88/pci.c"], "versions": [{"version": "cdb82c80b9349ed1d9ce6b49856128e04f4effc9", "lessThan": "1ef3d1338d94ec41f58fbfb6ba7742a27ea61d89", "status": "affected", "versionType": "git"}, {"version": "cdb82c80b9349ed1d9ce6b49856128e04f4effc9", "lessThan": "d7920797f721f944861f3c48ffb2b73f84b631fe", "status": "affected", "versionType": "git"}, {"version": "cdb82c80b9349ed1d9ce6b49856128e04f4effc9", "lessThan": "706183dbef4a79d120d4e928f693bea50df496f8", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/wireless/realtek/rtw88/pci.c"], "versions": [{"version": "6.17", "status": "affected"}, {"version": "0", "lessThan": "6.17", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.40", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.5", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.17", "versionEndExcluding": "6.18.40"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.17", "versionEndExcluding": "7.1.5"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.17", "versionEndExcluding": "7.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/1ef3d1338d94ec41f58fbfb6ba7742a27ea61d89"}, {"url": "https://git.kernel.org/stable/c/d7920797f721f944861f3c48ffb2b73f84b631fe"}, {"url": "https://git.kernel.org/stable/c/706183dbef4a79d120d4e928f693bea50df496f8"}], "title": "wifi: rtw88: fix wrong pci_get_drvdata type in AER handlers", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-74412", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-16T18:56:11.020937Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-16T19:05:44.326Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-74412", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-16T18:56:11.020937Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-16T18:56:11.565Z"}}], "cna": {"title": "wifi: rtw88: fix wrong pci_get_drvdata type in AER handlers", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 8.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:A - The vulnerable rtw88 PCIe WiFi AER handlers run when the adapter's PCIe link reports non-fatal/fatal errors; on laptops/desktops with these common adapters in public wireless environments, an adjacent attacker can plausibly induce such link faults via malicious wireless traffic stressing the radio-PCIe interface.\nAC:L - Once PCIe AER recovery is invoked on the rtw88 device, the type confusion deterministically misinterprets ieee80211_hw as net_device and corrupts memory via netif_device_detach/attach; no further race or layout conditions beyond triggering AER recovery are required.\nPR:N - Exploitation does not require local OS privileges or kernel capabilities; an adjacent wireless attacker targeting the victim's rtw88 PCIe WiFi adapter can trigger the faulty AER recovery path without authenticating to or having an account on the victim system.\nUI:N - Triggering PCIe error recovery and the resulting memory corruption does not require any action by the victim user beyond the system operating with the affected rtw88 WiFi hardware present and in use.\nS:U - The type confusion corrupts kernel memory within the same kernel security authority; it does not cross VM, container, or IOMMU boundaries to impact separate security domains.\nC:H - Casting ieee80211_hw to net_device causes netif_device_detach/attach to read fields at incorrect offsets (state, flags, queue metadata), constituting type confusion that can disclose adjacent kernel memory and is rated High per kernel CVSS guidance for type confusion.\nI:H - The bug performs atomic bit clears/sets and netif queue stop/wake operations on memory interpreted as net_device fields but actually within ieee80211_hw, enabling out-of-bounds writes and exploitable memory corruption consistent with High integrity impact.\nA:H - Misinterpreting ieee80211_hw as net_device leads netif_tx_stop_all_queues and netdev_watchdog_up to dereference garbage queue pointers and locks, causing kernel oops/panic during AER recovery and qualifying as High availability impact."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "cdb82c80b9349ed1d9ce6b49856128e04f4effc9", "lessThan": "1ef3d1338d94ec41f58fbfb6ba7742a27ea61d89", "versionType": "git"}, {"status": "affected", "version": "cdb82c80b9349ed1d9ce6b49856128e04f4effc9", "lessThan": "d7920797f721f944861f3c48ffb2b73f84b631fe", "versionType": "git"}, {"status": "affected", "version": "cdb82c80b9349ed1d9ce6b49856128e04f4effc9", "lessThan": "706183dbef4a79d120d4e928f693bea50df496f8", "versionType": "git"}], "programFiles": ["drivers/net/wireless/realtek/rtw88/pci.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.17"}, {"status": "unaffected", "version": "0", "lessThan": "6.17", "versionType": "semver"}, {"status": "unaffected", "version": "6.18.40", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "7.1.5", "versionType": "semver", "lessThanOrEqual": "7.1.*"}, {"status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/net/wireless/realtek/rtw88/pci.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/1ef3d1338d94ec41f58fbfb6ba7742a27ea61d89"}, {"url": "https://git.kernel.org/stable/c/d7920797f721f944861f3c48ffb2b73f84b631fe"}, {"url": "https://git.kernel.org/stable/c/706183dbef4a79d120d4e928f693bea50df496f8"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: rtw88: fix wrong pci_get_drvdata type in AER handlers\n\nrtw88 stores an ieee80211_hw pointer via pci_set_drvdata() at probe\ntime, but io_error_detected() and io_resume() retrieve it as a\nnet_device pointer. This causes netif_device_detach/attach to\noperate on an ieee80211_hw struct, reading and writing at wrong\noffsets.\n\nUse ieee80211_stop_queues/wake_queues instead, consistent with\nevery other queue stop/start path in the driver."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.18.40", "versionStartIncluding": "6.17"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.1.5", "versionStartIncluding": "6.17"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.2", "versionStartIncluding": "6.17"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-17T05:46:55.998Z"}}}, "cveMetadata": {"cveId": "CVE-2026-74412", "state": "PUBLISHED", "dateUpdated": "2026-10-16T19:05:44.326Z", "dateReserved": "2026-08-15T05:44:03.893Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2026-08-15T05:59:19.354Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/net/wireless/realtek/rtw88/pci.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "1ef3d1338d94ec41f58fbfb6ba7742a27ea61d89", "status": "affected", "version": "cdb82c80b9349ed1d9ce6b49856128e04f4effc9", "versionType": "git"}, {"lessThan": "d7920797f721f944861f3c48ffb2b73f84b631fe", "status": "affected", "version": "cdb82c80b9349ed1d9ce6b49856128e04f4effc9", "versionType": "git"}, {"lessThan": "706183dbef4a79d120d4e928f693bea50df496f8", "status": "affected", "version": "cdb82c80b9349ed1d9ce6b49856128e04f4effc9", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/net/wireless/realtek/rtw88/pci.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.17"}, {"lessThan": "6.17", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.40", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.5", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: rtw88: fix wrong pci_get_drvdata type in AER handlers\n\nrtw88 stores an ieee80211_hw pointer via pci_set_drvdata() at probe\ntime, but io_error_detected() and io_resume() retrieve it as a\nnet_device pointer. This causes netif_device_detach/attach to\noperate on an ieee80211_hw struct, reading and writing at wrong\noffsets.\n\nUse ieee80211_stop_queues/wake_queues instead, consistent with\nevery other queue stop/start path in the driver."}], "id": "CVE-2026-74412", "lastModified": "2026-10-16T20:17:26.923", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-74412", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-16T18:56:11.020937Z", "version": "2.0.3"}}]}, "published": "2026-08-15T06:22:43.317", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/1ef3d1338d94ec41f58fbfb6ba7742a27ea61d89"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/706183dbef4a79d120d4e928f693bea50df496f8"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/d7920797f721f944861f3c48ffb2b73f84b631fe"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: wifi: rtw88: fix wrong pci_get_drvdata type in AER handlers", "id": "2516847", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2516847"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-843", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nwifi: rtw88: fix wrong pci_get_drvdata type in AER handlers\nrtw88 stores an ieee80211_hw pointer via pci_set_drvdata() at probe\ntime, but io_error_detected() and io_resume() retrieve it as a\nnet_device pointer. This causes netif_device_detach/attach to\noperate on an ieee80211_hw struct, reading and writing at wrong\noffsets.\nUse ieee80211_stop_queues/wake_queues instead, consistent with\nevery other queue stop/start path in the driver.", "A flaw was found in the `rtw88` Wi-Fi driver within the Linux kernel. This vulnerability arises from a type confusion during PCI Advanced Error Reporting (AER) handling, where a hardware-related pointer is mistakenly interpreted as a network device pointer. This misinterpretation causes the driver to perform operations on incorrect memory locations, leading to memory corruption. Such an issue can result in system instability or a denial of service."], "name": "CVE-2026-74412", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-08-15T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-74412\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-74412\nhttps://lore.kernel.org/linux-cve-announce/2026081511-CVE-2026-74412-513f@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[cdb82c80b9349ed1d9ce6b49856128e04f4effc9,1ef3d1338d94ec41f58fbfb6ba7742a27ea61d89)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[cdb82c80b9349ed1d9ce6b49856128e04f4effc9,d7920797f721f944861f3c48ffb2b73f84b631fe)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[cdb82c80b9349ed1d9ce6b49856128e04f4effc9,706183dbef4a79d120d4e928f693bea50df496f8)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.17"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,6.17)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.40,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.1.5,7.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.2-rc1,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-08-15T14:00:08.920665+00:00", "updated": "2026-08-22T02:45:03.710782+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}