CVE-2026-74413 in Linux
Summary
by MITRE • 08/15/2026
In the Linux kernel, the following vulnerability has been resolved:
wifi: rtw89: fix wrong pci_get_drvdata type in AER handlers
rtw89 stores an ieee80211_hw pointer via pci_set_drvdata() at probe time, but io_error_detected() and io_resume() retrieve it as a net_device pointer. This causes netif_device_detach/attach to operate on an ieee80211_hw struct, reading and writing at wrong offsets. The adjacent io_slot_reset() already does it correctly.
Use ieee80211_stop_queues/wake_queues instead, consistent with every other queue stop/start path in the driver.
Tested on RTL8852CE by calling the handlers from a test module before and after the fix.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/15/2026
The vulnerability in question affects the rtw89 wireless driver within the Linux kernel, specifically addressing an incorrect data type handling in Advanced Error Reporting (AER) error recovery handlers. This flaw demonstrates a critical type confusion issue where the driver improperly manages pointer types during hardware error recovery operations. The root cause lies in how the driver stores and retrieves device context information during the probe phase versus error recovery handlers, creating a mismatch that can lead to memory corruption and system instability.
The technical implementation flaw occurs when the rtw89 driver initially stores an ieee80211_hw pointer using pci_set_drvdata() during device initialization. However, during error recovery operations, the io_error_detected() and io_resume() functions attempt to retrieve this stored context as a net_device pointer instead of maintaining the original ieee80211_hw type. This type mismatch results in memory access violations where the driver performs netif_device_detach/attach operations on an ieee80211_hw structure rather than a proper net_device structure, causing incorrect memory offsets and potentially corrupting adjacent data structures.
This vulnerability directly impacts wireless network connectivity and system stability by affecting the error recovery mechanisms that should gracefully handle hardware errors without compromising system integrity. The improper handling of queue management functions through incorrect pointer dereferencing can lead to kernel panics, unexpected disconnections, or persistent network interface failures. The issue is particularly concerning because it affects the AER error handling paths which are critical for maintaining system reliability during hardware anomalies or transient faults in PCIe devices.
The fix implements a proper type consistency approach by modifying the error recovery handlers to correctly retrieve the stored ieee80211_hw pointer and use appropriate queue management functions. Specifically, the solution replaces netif_device_detach/attach operations with ieee80211_stop_queues/wake_queues calls that are consistent with all other queue management paths within the driver. This approach aligns with established kernel networking patterns and ensures proper queue state management without corrupting memory structures.
The vulnerability relates to CWE-835 which addresses infinite loops in the context of type confusion issues, though it manifests more specifically as a memory corruption due to improper pointer handling rather than an infinite loop. From an ATT&CK perspective, this represents a potential privilege escalation vector through kernel memory corruption, affecting the system's availability and integrity. The fix demonstrates proper defensive programming practices by ensuring type consistency in driver context management during error recovery scenarios.
Testing procedures confirmed that the issue was present before the fix and resolved after implementation, with verification performed using a dedicated test module that called the affected handlers directly on RTL8852CE hardware. This validation approach ensures that the specific AER error recovery paths function correctly without introducing regressions in normal operation. The solution maintains compatibility with existing wireless networking functionality while strengthening the driver's resilience to hardware errors and improving overall system stability during PCIe error conditions.