Vulnerability-Lookup

GHSA-R36V-QWFG-3X64

Vulnerability from github – Published: 2026-08-15 06:32 – Updated: 2026-08-17 06:33

Details

In the Linux kernel, the following vulnerability has been resolved:

wifi: rtw88: fix wrong pci_get_drvdata type in AER handlers

rtw88 stores an ieee80211_hw pointer via pci_set_drvdata() at probe time, but io_error_detected() and io_resume() retrieve it as a net_device pointer. This causes netif_device_detach/attach to operate on an ieee80211_hw struct, reading and writing at wrong offsets.

Use ieee80211_stop_queues/wake_queues instead, consistent with every other queue stop/start path in the driver.

Severity

8.8 (High)


                  
                    CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-74412"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-08-15T06:22:43Z",
    "severity": "HIGH"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: rtw88: fix wrong pci_get_drvdata type in AER handlers\n\nrtw88 stores an ieee80211_hw pointer via pci_set_drvdata() at probe\ntime, but io_error_detected() and io_resume() retrieve it as a\nnet_device pointer.  This causes netif_device_detach/attach to\noperate on an ieee80211_hw struct, reading and writing at wrong\noffsets.\n\nUse ieee80211_stop_queues/wake_queues instead, consistent with\nevery other queue stop/start path in the driver.",
  "id": "GHSA-r36v-qwfg-3x64",
  "modified": "2026-08-17T06:33:44Z",
  "published": "2026-08-15T06:32:33Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-74412"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/1ef3d1338d94ec41f58fbfb6ba7742a27ea61d89"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/706183dbef4a79d120d4e928f693bea50df496f8"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/d7920797f721f944861f3c48ffb2b73f84b631fe"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

CVE-2026-74412 (GCVE-0-2026-74412)

Vulnerability from cvelistv5 – Published: 2026-08-15 05:59 – Updated: 2026-08-17 05:46

Title

wifi: rtw88: fix wrong pci_get_drvdata type in AER handlers

Summary

In the Linux kernel, the following vulnerability has been resolved: wifi: rtw88: fix wrong pci_get_drvdata type in AER handlers rtw88 stores an ieee80211_hw pointer via pci_set_drvdata() at probe time, but io_error_detected() and io_resume() retrieve it as a net_device pointer. This causes netif_device_detach/attach to operate on an ieee80211_hw struct, reading and writing at wrong offsets. Use ieee80211_stop_queues/wake_queues instead, consistent with every other queue stop/start path in the driver.

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Assigner

Linux mitre root Scorecard

References

3 references

URL	Tags
https://git.kernel.org/stable/c/1ef3d1338d94ec41f…
https://git.kernel.org/stable/c/d7920797f721f9448…
https://git.kernel.org/stable/c/706183dbef4a79d12…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: cdb82c80b9349ed1d9ce6b49856128e04f4effc9 , < 1ef3d1338d94ec41f58fbfb6ba7742a27ea61d89 (git) Affected: cdb82c80b9349ed1d9ce6b49856128e04f4effc9 , < d7920797f721f944861f3c48ffb2b73f84b631fe (git) Affected: cdb82c80b9349ed1d9ce6b49856128e04f4effc9 , < 706183dbef4a79d120d4e928f693bea50df496f8 (git)
Linux	Linux	Affected: 6.17 Unaffected: 0 , < 6.17 (semver) Unaffected: 6.18.40 , ≤ 6.18.* (semver) Unaffected: 7.1.5 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wireless/realtek/rtw88/pci.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "1ef3d1338d94ec41f58fbfb6ba7742a27ea61d89",
              "status": "affected",
              "version": "cdb82c80b9349ed1d9ce6b49856128e04f4effc9",
              "versionType": "git"
            },
            {
              "lessThan": "d7920797f721f944861f3c48ffb2b73f84b631fe",
              "status": "affected",
              "version": "cdb82c80b9349ed1d9ce6b49856128e04f4effc9",
              "versionType": "git"
            },
            {
              "lessThan": "706183dbef4a79d120d4e928f693bea50df496f8",
              "status": "affected",
              "version": "cdb82c80b9349ed1d9ce6b49856128e04f4effc9",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wireless/realtek/rtw88/pci.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.17"
            },
            {
              "lessThan": "6.17",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.40",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.40",
                  "versionStartIncluding": "6.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "6.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.17",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: rtw88: fix wrong pci_get_drvdata type in AER handlers\n\nrtw88 stores an ieee80211_hw pointer via pci_set_drvdata() at probe\ntime, but io_error_detected() and io_resume() retrieve it as a\nnet_device pointer.  This causes netif_device_detach/attach to\noperate on an ieee80211_hw struct, reading and writing at wrong\noffsets.\n\nUse ieee80211_stop_queues/wake_queues instead, consistent with\nevery other queue stop/start path in the driver."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:A - The vulnerable rtw88 PCIe WiFi AER handlers run when the adapter\u0027s PCIe link reports non-fatal/fatal errors; on laptops/desktops with these common adapters in public wireless environments, an adjacent attacker can plausibly induce such link faults via malicious wireless traffic stressing the radio-PCIe interface.\nAC:L - Once PCIe AER recovery is invoked on the rtw88 device, the type confusion deterministically misinterprets ieee80211_hw as net_device and corrupts memory via netif_device_detach/attach; no further race or layout conditions beyond triggering AER recovery are required.\nPR:N - Exploitation does not require local OS privileges or kernel capabilities; an adjacent wireless attacker targeting the victim\u0027s rtw88 PCIe WiFi adapter can trigger the faulty AER recovery path without authenticating to or having an account on the victim system.\nUI:N - Triggering PCIe error recovery and the resulting memory corruption does not require any action by the victim user beyond the system operating with the affected rtw88 WiFi hardware present and in use.\nS:U - The type confusion corrupts kernel memory within the same kernel security authority; it does not cross VM, container, or IOMMU boundaries to impact separate security domains.\nC:H - Casting ieee80211_hw to net_device causes netif_device_detach/attach to read fields at incorrect offsets (state, flags, queue metadata), constituting type confusion that can disclose adjacent kernel memory and is rated High per kernel CVSS guidance for type confusion.\nI:H - The bug performs atomic bit clears/sets and netif queue stop/wake operations on memory interpreted as net_device fields but actually within ieee80211_hw, enabling out-of-bounds writes and exploitable memory corruption consistent with High integrity impact.\nA:H - Misinterpreting ieee80211_hw as net_device leads netif_tx_stop_all_queues and netdev_watchdog_up to dereference garbage queue pointers and locks, causing kernel oops/panic during AER recovery and qualifying as High availability impact."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T05:46:55.998Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/1ef3d1338d94ec41f58fbfb6ba7742a27ea61d89"
        },
        {
          "url": "https://git.kernel.org/stable/c/d7920797f721f944861f3c48ffb2b73f84b631fe"
        },
        {
          "url": "https://git.kernel.org/stable/c/706183dbef4a79d120d4e928f693bea50df496f8"
        }
      ],
      "title": "wifi: rtw88: fix wrong pci_get_drvdata type in AER handlers",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74412",
    "datePublished": "2026-08-15T05:59:19.354Z",
    "dateReserved": "2026-08-15T05:44:03.893Z",
    "dateUpdated": "2026-08-17T05:46:55.998Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

GHSA-R36V-QWFG-3X64

CVE-2026-74412 (GCVE-0-2026-74412)

Tags

Sightings

Nomenclature

Related by attack behaviour