CVE-2026-97516

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-97516", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-24T16:01:01.152Z", "datePublished": "2026-09-24T16:05:14.263Z", "dateUpdated": "2026-10-03T10:59:10.452Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-03T10:59:10.452Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: rtw88: Add NULL check for chip->edcca_th in rtw_fw_adaptivity_result()\n\nIt was recently reported that rtw_fw_adaptivity_result()\nin fw.c dereferences rtwdev->chip->edcca_th without\na NULL check. The issue is that devices with the\n8821CE chip don't define edcca_th in their chip\ninfo. As a result, when rtw_fw_adaptivity_result()\ntries to dereference it, the kernel triggers an oops.\n\nAdd a NULL check for edcca_th before dereferencing\nit in rtw_fw_adaptivity_result() in fw.c. Placing\nthe check at the function entry avoids logging any\ngarbage values.\n\nThis change does not address the root cause for\nthis behavior, but it prevents the NULL dereference\nand the resulting oops while a more permanent solution\nis developed.\n\nTested on a 8822CE chip which defines edcca_th, so\nthis issue is not present on it, but it still uses\nthis driver and I can verify there are no regressions."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/wireless/realtek/rtw88/fw.c"], "versions": [{"version": "fe7bc23a8c5eba8a49061c1d15d0a9d45ef18130", "lessThan": "a8cdb18ef80d67790d8611ba94ae3d81901c9e04", "status": "affected", "versionType": "git"}, {"version": "fe7bc23a8c5eba8a49061c1d15d0a9d45ef18130", "lessThan": "0b58a5ac9170a6f5e6425f8e1a4b3e1d9c2bf53d", "status": "affected", "versionType": "git"}, {"version": "fe7bc23a8c5eba8a49061c1d15d0a9d45ef18130", "lessThan": "6fa23cafaf30f4877e357f8eebcff00dff4aa9cb", "status": "affected", "versionType": "git"}, {"version": "fe7bc23a8c5eba8a49061c1d15d0a9d45ef18130", "lessThan": "1d1f250432cd8704c3c125168887f9724021c81a", "status": "affected", "versionType": "git"}, {"version": "fe7bc23a8c5eba8a49061c1d15d0a9d45ef18130", "lessThan": "d5e6f353ce1e1c25b8458ea390ed09d2377412c5", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/wireless/realtek/rtw88/fw.c"], "versions": [{"version": "5.16", "status": "affected"}, {"version": "0", "lessThan": "5.16", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.189", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.158", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.111", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.53", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.16", "versionEndExcluding": "6.1.189"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.16", "versionEndExcluding": "6.6.158"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.16", "versionEndExcluding": "6.12.111"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.16", "versionEndExcluding": "6.18.53"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.16", "versionEndExcluding": "7.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/a8cdb18ef80d67790d8611ba94ae3d81901c9e04"}, {"url": "https://git.kernel.org/stable/c/0b58a5ac9170a6f5e6425f8e1a4b3e1d9c2bf53d"}, {"url": "https://git.kernel.org/stable/c/6fa23cafaf30f4877e357f8eebcff00dff4aa9cb"}, {"url": "https://git.kernel.org/stable/c/1d1f250432cd8704c3c125168887f9724021c81a"}, {"url": "https://git.kernel.org/stable/c/d5e6f353ce1e1c25b8458ea390ed09d2377412c5"}], "title": "wifi: rtw88: Add NULL check for chip->edcca_th in rtw_fw_adaptivity_result()", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/net/wireless/realtek/rtw88/fw.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "a8cdb18ef80d67790d8611ba94ae3d81901c9e04", "status": "affected", "version": "fe7bc23a8c5eba8a49061c1d15d0a9d45ef18130", "versionType": "git"}, {"lessThan": "0b58a5ac9170a6f5e6425f8e1a4b3e1d9c2bf53d", "status": "affected", "version": "fe7bc23a8c5eba8a49061c1d15d0a9d45ef18130", "versionType": "git"}, {"lessThan": "6fa23cafaf30f4877e357f8eebcff00dff4aa9cb", "status": "affected", "version": "fe7bc23a8c5eba8a49061c1d15d0a9d45ef18130", "versionType": "git"}, {"lessThan": "1d1f250432cd8704c3c125168887f9724021c81a", "status": "affected", "version": "fe7bc23a8c5eba8a49061c1d15d0a9d45ef18130", "versionType": "git"}, {"lessThan": "d5e6f353ce1e1c25b8458ea390ed09d2377412c5", "status": "affected", "version": "fe7bc23a8c5eba8a49061c1d15d0a9d45ef18130", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/net/wireless/realtek/rtw88/fw.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.16"}, {"lessThan": "5.16", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.189", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.158", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.111", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.53", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: rtw88: Add NULL check for chip->edcca_th in rtw_fw_adaptivity_result()\n\nIt was recently reported that rtw_fw_adaptivity_result()\nin fw.c dereferences rtwdev->chip->edcca_th without\na NULL check. The issue is that devices with the\n8821CE chip don't define edcca_th in their chip\ninfo. As a result, when rtw_fw_adaptivity_result()\ntries to dereference it, the kernel triggers an oops.\n\nAdd a NULL check for edcca_th before dereferencing\nit in rtw_fw_adaptivity_result() in fw.c. Placing\nthe check at the function entry avoids logging any\ngarbage values.\n\nThis change does not address the root cause for\nthis behavior, but it prevents the NULL dereference\nand the resulting oops while a more permanent solution\nis developed.\n\nTested on a 8822CE chip which defines edcca_th, so\nthis issue is not present on it, but it still uses\nthis driver and I can verify there are no regressions."}], "id": "CVE-2026-97516", "lastModified": "2026-10-03T11:18:00.840", "metrics": {}, "published": "2026-09-24T17:17:29.550", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/0b58a5ac9170a6f5e6425f8e1a4b3e1d9c2bf53d"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/1d1f250432cd8704c3c125168887f9724021c81a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/6fa23cafaf30f4877e357f8eebcff00dff4aa9cb"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/a8cdb18ef80d67790d8611ba94ae3d81901c9e04"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/d5e6f353ce1e1c25b8458ea390ed09d2377412c5"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: wifi: rtw88: Add NULL check for chip->edcca_th in rtw_fw_adaptivity_result()", "id": "2540546", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2540546"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-476", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nwifi: rtw88: Add NULL check for chip->edcca_th in rtw_fw_adaptivity_result()\nIt was recently reported that rtw_fw_adaptivity_result()\nin fw.c dereferences rtwdev->chip->edcca_th without\na NULL check. The issue is that devices with the\n8821CE chip don't define edcca_th in their chip\ninfo. As a result, when rtw_fw_adaptivity_result()\ntries to dereference it, the kernel triggers an oops.\nAdd a NULL check for edcca_th before dereferencing\nit in rtw_fw_adaptivity_result() in fw.c. Placing\nthe check at the function entry avoids logging any\ngarbage values.\nThis change does not address the root cause for\nthis behavior, but it prevents the NULL dereference\nand the resulting oops while a more permanent solution\nis developed.\nTested on a 8822CE chip which defines edcca_th, so\nthis issue is not present on it, but it still uses\nthis driver and I can verify there are no regressions.", "A flaw was found in the Linux kernel's rtw88 wireless driver. The driver fails to verify whether certain hardware configuration settings exist before accessing them during firmware adaptivity processing. On systems equipped with specific wireless chipsets, this flaw triggers a null pointer dereference that crashes the kernel, resulting in a Denial of Service (DoS)."], "name": "CVE-2026-97516", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-09-24T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-97516\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-97516\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-97516.mbox"], "threat_severity": "Low"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,6fa23cafaf30f4877e357f8eebcff00dff4aa9cb)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,1d1f250432cd8704c3c125168887f9724021c81a)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,d5e6f353ce1e1c25b8458ea390ed09d2377412c5)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,6.12.111)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,6.18.53)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.111,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.53,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.2,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-09-25T01:45:16.945579+00:00", "updated": "2026-10-01T10:30:08.278826+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}