CVE-2026-74410 in Linux
Summary
by MITRE • 08/15/2026
In the Linux kernel, the following vulnerability has been resolved:
wifi: rtw88: fix OOB read from firmware RX descriptor exceeding DMA buffer
In rtw_pci_rx_napi(), new_len is computed as the sum of pkt_len (14-bit descriptor field, max 16383) and pkt_offset (drv_info_sz + shift, both firmware-controlled). The result can exceed RTK_PCI_RX_BUF_SIZE (11478), causing an out-of-bounds read from the pre-allocated DMA buffer when skb_put_data copies new_len bytes. The USB transport already validates this (rtw_usb_rx_data_put checks against RTW_USB_MAX_RECVBUF_SZ); the PCIe path does not.
Add a check that new_len does not exceed the DMA buffer size.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/15/2026
The vulnerability in question affects the rtw88 wireless driver within the Linux kernel, specifically impacting devices utilizing PCIe-based Realtek wireless adapters. This issue represents a classic out-of-bounds read condition that arises from insufficient input validation during packet processing operations. The flaw exists in the rtw_pci_rx_napi() function where packet length and offset values are computed without proper boundary checking against allocated DMA buffer limits. The vulnerability stems from the accumulation of two firmware-controlled parameters where pkt_len, a 14-bit descriptor field with maximum value of 16383 bytes, is added to pkt_offset which consists of drv_info_sz plus shift values also controlled by firmware components.
The technical execution of this vulnerability occurs when the driver processes incoming wireless packets through the PCIe transport mechanism. The computation of new_len combines these two values without verifying that the resulting sum remains within acceptable bounds for the pre-allocated DMA buffer. When the packet size calculation exceeds the RTK_PCI_RX_BUF_SIZE limit of 11478 bytes, the skb_put_data function attempts to copy more data than allocated, leading to memory access beyond intended boundaries. This condition creates potential for information disclosure, system instability, or privilege escalation depending on exploitation vectors and system configurations.
The operational impact of this vulnerability extends across various network security scenarios where wireless connectivity is critical. Systems utilizing affected Realtek PCIe wireless adapters become susceptible to memory corruption attacks that could potentially be leveraged by malicious actors within proximity to the target device. The vulnerability affects both enterprise and consumer environments where wireless networking is employed, particularly in scenarios involving untrusted wireless networks or man-in-the-middle attack conditions. Organizations relying on Linux-based systems for network infrastructure, IoT deployments, or mobile computing platforms face heightened risk due to the widespread adoption of Realtek wireless chipsets.
The fix implemented addresses this issue by adding a validation check that prevents new_len from exceeding the DMA buffer size limits before any memory operations occur. This approach follows established security principles of input validation and boundary checking that align with common weakness enumerations such as CWE-129, which addresses improper validation of array indices, and CWE-787, covering out-of-bounds write vulnerabilities that often manifest in similar patterns. The solution also demonstrates adherence to defensive programming practices that are recommended in security frameworks like the OWASP Top Ten and NIST Cybersecurity Framework. The implementation mirrors the existing protection mechanisms already present in the USB transport path of the same driver, ensuring consistency across different hardware interfaces and maintaining the principle of least privilege in kernel space operations.
This vulnerability analysis reveals a significant gap in the PCIe transport layer validation compared to the USB transport which already implemented proper boundary checks as indicated by the reference to RTW_USB_MAX_RECVBUF_SZ validation. The inconsistency between transport mechanisms highlights potential design flaws in driver architecture where similar security protections are not uniformly applied across different hardware pathways. The fix ensures that all packet processing paths maintain equivalent security postures and prevents exploitation through memory corruption techniques that could be used to escalate privileges or execute arbitrary code within kernel space. This remediation approach aligns with ATT&CK framework techniques related to privilege escalation and defense evasion, as the vulnerability could potentially be leveraged to bypass kernel security controls and establish persistent access to affected systems.
The resolution of this issue demonstrates the importance of comprehensive testing across all transport mechanisms in device drivers, particularly when implementing firmware-controlled parameters that can influence memory allocation boundaries. The fix reinforces fundamental security concepts including input sanitization, buffer overflow prevention, and proper resource management within kernel space operations. By implementing this validation check, the driver maintains memory integrity while preserving functionality for legitimate network traffic processing. This vulnerability serves as an example of how seemingly minor implementation gaps in device drivers can create significant security risks that require careful attention to boundary conditions and input validation throughout the software stack.