Executive brief
The rtw88 wireless driver in the Linux kernel contains a type mismatch bug in its PCI error recovery handlers. During PCI error detection and recovery, the driver incorrectly casts a wireless hardware pointer as a network device pointer, causing it to read and write memory at wrong offsets. This can lead to memory corruption, system crashes, or denial of service when PCI errors occur on affected wireless adapters.
Technical details
The vulnerability exists in the rtw88 PCI driver's error handlers (io_error_detected and io_resume functions). The driver stores an ieee80211_hw pointer via pci_set_drvdata() but retrieves it as a net_device pointer in the error recovery path. This type mismatch causes netif_device_detach() and netif_device_attach() to operate on an ieee80211_hw struct at incorrect memory offsets, resulting in memory corruption. The fix replaces these calls with ieee80211_stop_queues() and ieee80211_wake_queues(), which operate on the correct data structure. The vulnerability is triggered when a PCI Express error is detected during driver operation, requiring no user interaction but affecting any system with affected rtw88 wireless hardware.
Affected products
- Linux Linux Kernel kernel versions containing commit cdb82c80b934 and earlier; fixed in upstream and backported to stable branches
Timeline
- 2026-08-15: disclosed
- 2026-04-29: patched: Original fix committed upstream