CVE-2026-74410: wifi: rtw88: fix OOB read from firmware RX descriptor exceeding DMA buffer
In the Linux kernel, the following vulnerability has been resolved:
wifi: rtw88: fix OOB read from firmware RX descriptor exceeding DMA buffer
In rtwpcirxnapi(), newlen is computed as the sum of pktlen (14-bit descriptor field, max 16383) and pktoffset (drvinfosz + shift, both firmware-controlled). The result can exceed RTKPCIRXBUFSIZE (11478), causing an out-of-bounds read from the pre-allocated DMA buffer when skbputdata copies newlen bytes. The USB transport already validates this (rtwusbrxdataput checks against RTWUSBMAXRECVBUFSZ); the PCIe path does not.
Add a check that newlen does not exceed the DMA buffer size.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Add/ensure a bounds check in rtw_pci_rx_napi() so that computed new_len (sum of pkt_len and pkt_offset-derived lengths) does not exceed the DMA buffer size RTK_PCI_RX_BUF_SIZE (11478), preventing out-of-bounds reads from the pre-allocated DMA buffer before calling skb_put_data.
Realtek rtw88 (wifi) RTK_PCI_RX_BUF_SIZE = 11478
Event History
Frequently Asked Questions
What is the severity of CVE-2026-74410?
CVE-2026-74410 has a risk rating of 33, indicating a moderate severity level.
How do I fix CVE-2026-74410?
To fix CVE-2026-74410, ensure your Linux kernel is updated to a version that includes the security patch addressing this vulnerability.
What type of vulnerability is CVE-2026-74410?
CVE-2026-74410 is classified as an out-of-bounds (OOB) read vulnerability in the Linux kernel's wifi driver.
What is the impact of CVE-2026-74410?
The impact of CVE-2026-74410 includes potential data corruption or information leakage due to improper handling of firmware RX descriptors.
Which components are affected by CVE-2026-74410?
CVE-2026-74410 primarily affects the rtw88 wifi driver component in the Linux kernel.