Riskcovery

CVE-2026-74409

wifi: rtw89: add bounds check on firmware mac_id in link lookup

State
Published
Severity
8.8 High
Published
Aug 15, 2026
Updated
Oct 16, 2026
Reserved
Aug 15, 2026

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

wifi: rtw89: add bounds check on firmware mac_id in link lookup

The mac_id field in RX descriptors is 8 bits wide (0-255), but assoc_link_on_macid[] has only RTW89_MAX_MAC_ID_NUM (128) entries. While the driver currently assigns mac_id values below 128, the descriptor value comes from firmware and is not validated before use as an array index. Add a defensive bounds check in rtw89_assoc_link_rcu_dereference() to guard against out-of-range firmware values.

Scores

CVSSScoreVectorSource
3.18.8 HighCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HLinux

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • 144c6cd24b3556e6e7a14271cee57a42ebf97450 to before ad445de67359f24088d4305c05fbd7e34c4e35e3Affected
  • 144c6cd24b3556e6e7a14271cee57a42ebf97450 to before 920101305e7601a33b9e01019f4ca526af2526aeAffected
  • 144c6cd24b3556e6e7a14271cee57a42ebf97450 to before 6d88244bb129755acca696f9227200f4a2d106a6Affected
LinuxLinux
  • 6.14Affected
  • before 6.14Not affected
  • 6.18.40 through 6.18.*Not affected
  • 7.1.5 through 7.1.*Not affected
  • 7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.