CVE-2026-74413 Linux CVE debrief

Who should care

Linux kernel maintainers, Linux distribution vendors, and users of Linux systems with the wifi rtw89 driver enabled should assess their exposure and apply patches or mitigations as necessary.

Why it matters

This vulnerability in the Linux kernel's wifi rtw89 driver could lead to system instability or denial of service if exploited. Linux kernel maintainers, Linux distribution vendors, and users of Linux systems with the wifi rtw89 driver enabled should assess their exposure and apply patches or mitigations as necessary.

• Denial of service due to system instability
• Incorrect queue operations leading to potential crashes
• Need for patching to prevent potential exploitation
• Verification of system logs for signs of exploitation attempts

Technical summary

The Linux kernel's wifi rtw89 driver has a vulnerability due to incorrect handling of pci_get_drvdata in AER handlers. An ieee80211_hw pointer is stored via pci_set_drvdata() but retrieved as a net_device pointer, leading to incorrect operations on an ieee80211_hw struct. This mismatch causes netif_device_detach/attach to operate on incorrect offsets, potentially leading to system instability or denial of service. The issue is resolved by using ieee80211_stop_queues/wake_queues consistently with other queue stop/start paths in the driver. Affected Linux kernel deployments using the wifi rtw89 driver should assess their exposure and apply patches or mitigations as necessary to prevent potential exploitation.

Defensive priority

Medium

Recommended defensive actions

• Review and apply the patches provided by the Linux kernel maintainers.
• Ensure that the Linux kernel is updated to a version that includes the fix.
• Monitor system logs for potential issues related to the wifi rtw89 driver.
• Verify system configurations for compliance with Linux kernel security advisories.
• Track changes to Linux kernel versions and updates for the rtw89 driver.
• Perform regular security audits to identify potential vulnerabilities.
• Review system exposure and apply mitigations as necessary.

Evidence notes

The CVE record and source item provide details on the vulnerability, including its description, affected versions, and references to source code changes. However, there is limited information on potential exploits or victim impact.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.