Junglewise Threat Intelligence

CVE-2026-74413: Linux kernel rtw89 type casting error in AER error handlers

CVE-2026-74413 · Severity: high · CVSS 8.8 · Published 2026-08-15

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

The rtw89 WiFi driver in the Linux kernel contains a type casting bug in its PCI error recovery handlers. When the system experiences a PCI link error, the driver incorrectly casts driver data to a network device instead of the correct hardware structure, causing it to read and write memory at wrong offsets. This could lead to system instability or crashes during PCI error recovery.

Technical details

The vulnerability is a type casting error in the PCI AER (Advanced Error Reporting) handlers. The driver stores an ieee80211_hw pointer via pci_set_drvdata() at probe time, but the io_error_detected() and io_resume() handlers retrieve it as a net_device pointer, causing netif_device_detach/attach to operate on the wrong structure and read/write at incorrect memory offsets. The adjacent io_slot_reset() handler already uses the correct type. The fix replaces the incorrect netif_device_detach/attach calls with ieee80211_stop_queues/wake_queues. The vulnerability is triggered during PCI error conditions and requires no authentication or user interaction, but depends on a PCI error event occurring.

Affected products

  • Linux Linux kernel Multiple versions (affected by commit 16e3d93c6183)

Timeline

  • 2026-08-15: disclosed: CVE published
  • 2026-03-29: patched: Fix committed upstream
  • 2026-07-24: patched: Fix backported to stable kernels

References

Related threats