CVE-2026-74409 in Linux
Summary
by MITRE • 08/15/2026
In the Linux kernel, the following vulnerability has been resolved:
wifi: rtw89: add bounds check on firmware mac_id in link lookup
The mac_id field in RX descriptors is 8 bits wide (0-255), but assoc_link_on_macid[] has only RTW89_MAX_MAC_ID_NUM (128) entries.
While the driver currently assigns mac_id values below 128, the descriptor value comes from firmware and is not validated before use as an array index. Add a defensive bounds check in rtw89_assoc_link_rcu_dereference() to guard against out-of-range firmware values.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/15/2026
The vulnerability identified in the Linux kernel's rtw89 wireless driver represents a classic buffer overflow risk stemming from inadequate input validation. This issue affects the Realtek 802.11 wireless subsystem where firmware-generated data is directly used as array indices without proper bounds verification. The mac_id field within RX descriptors operates on an 8-bit value range spanning 0 to 255, while the internal assoc_link_on_macid[] array maintains only 128 valid entries designated by RTW89_MAX_MAC_ID_NUM. This fundamental mismatch creates a potential exploitation vector where malicious firmware could provide mac_id values exceeding the array bounds, leading to memory corruption and system instability.
The technical flaw manifests in the rtw89_assoc_link_rcu_dereference() function which processes firmware-provided mac_id values without implementing defensive bounds checking. When firmware delivers an RX descriptor containing a mac_id value between 128 and 255, the driver attempts to access assoc_link_on_macid[mac_id] directly, bypassing any validation mechanism that should ensure the index remains within the 0-127 range. This primitive but critical oversight allows for potential out-of-bounds memory access patterns that could result in arbitrary code execution or system crashes. The vulnerability aligns with CWE-129, which specifically addresses insufficient bounds checking on external inputs, and represents a direct violation of secure coding principles for array indexing operations.
The operational impact of this vulnerability extends beyond simple system instability to potential security compromise within wireless networking environments. An attacker capable of manipulating firmware behavior or exploiting a compromised wireless access point could leverage this flaw to execute arbitrary code within the kernel space, potentially escalating privileges and gaining full control over affected systems. The rtw89 driver serves numerous Realtek wireless network adapters across various Linux distributions, making this vulnerability widespread in scope. Network administrators should consider this issue as part of broader ATT&CK framework considerations under T1059.001 for command and scripting interpreter and T1068 for exploit for privilege escalation, particularly when evaluating wireless infrastructure security postures.
Mitigation strategies should focus on implementing robust input validation mechanisms in the driver code, specifically adding bounds checking before array access operations. The fix requires modifying rtw89_assoc_link_rcu_dereference() to validate mac_id values against the maximum supported array size, ensuring that any value exceeding RTW89_MAX_MAC_ID_NUM is either rejected or clamped to valid range. Additionally, system administrators should ensure timely patch deployment across all affected wireless network adapters and consider implementing network segmentation to limit potential attack surfaces. The solution aligns with secure coding practices recommended in the CERT Secure Coding Standards, particularly guidelines addressing array bounds checking and defensive programming techniques for kernel space drivers.