CVE-2026-74410 Linux CVE debrief

Who should care

Defenders responsible for Linux kernel systems with exposed wifi interfaces should assess exposure and prioritize patching vulnerable systems. They should also verify DMA buffer sizes and firmware RX descriptor validation, and monitor for potential unusual activity on wifi interfaces. Additionally, defenders should review compensating controls for exposed systems while remediation is scheduled and verified.

Why it matters

The Linux kernel vulnerability in the rtw88 wifi driver allows for an out-of-bounds read, potentially leading to data exposure or system instability. Defenders should prioritize patching vulnerable systems, particularly those with exposed wifi interfaces, and monitor for potential unusual activity.

• Potential data exposure or corruption due to out-of-bounds read
• Possible system crashes or instability due to invalid data processing
• Need for verification of DMA buffer sizes and firmware RX descriptor validation
• Priority for patching vulnerable systems, especially those with exposed wifi interfaces

Technical summary

The rtw_pci_rx_napi() function in the Linux kernel's rtw88 wifi driver does not validate the new_len value computed from pkt_len and pkt_offset, leading to an out-of-bounds read from the pre-allocated DMA buffer when skb_put_data copies new_len bytes. The vulnerability can cause potential data exposure or system instability. The issue arises from the lack of validation of the new_len value, which can exceed the RTK_PCI_RX_BUF_SIZE, causing an out-of-bounds read. Defenders should prioritize patching vulnerable systems, particularly those with exposed wifi interfaces.

Defensive priority

Defenders should prioritize patching vulnerable systems, particularly those with exposed wifi interfaces, and monitor for potential unusual activity.

Recommended defensive actions

• Patch vulnerable Linux kernel systems, especially those with exposed wifi interfaces
• Monitor for unusual activity on wifi interfaces
• Verify DMA buffer sizes and firmware RX descriptor validation
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, but do not specify which kernel versions are affected or provide additional information on exploitation. The Linux kernel's rtw88 wifi driver does not validate the new_len value computed from pkt_len and pkt_offset, leading to an out-of-bounds read from the pre-allocated DMA buffer when skb_put_data copies new_len bytes. There is no indication of exploitation in the wild, but defenders should verify DMA buffer sizes and firmware RX descriptor validation.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.