Executive brief
The rtw89 WiFi driver in the Linux kernel contains a type casting bug in its PCI error recovery handlers. When the system experiences a PCI link error, the driver incorrectly casts driver data to a network device instead of the correct hardware structure, causing it to read and write memory at wrong offsets. This could lead to system instability or crashes during PCI error recovery.
Technical details
The vulnerability is a type casting error in the PCI AER (Advanced Error Reporting) handlers. The driver stores an ieee80211_hw pointer via pci_set_drvdata() at probe time, but the io_error_detected() and io_resume() handlers retrieve it as a net_device pointer, causing netif_device_detach/attach to operate on the wrong structure and read/write at incorrect memory offsets. The adjacent io_slot_reset() handler already uses the correct type. The fix replaces the incorrect netif_device_detach/attach calls with ieee80211_stop_queues/wake_queues. The vulnerability is triggered during PCI error conditions and requires no authentication or user interaction, but depends on a PCI error event occurring.
Affected products
- Linux Linux kernel Multiple versions (affected by commit 16e3d93c6183)
Timeline
- 2026-08-15: disclosed: CVE published
- 2026-03-29: patched: Fix committed upstream
- 2026-07-24: patched: Fix backported to stable kernels