Linux Kernel CVE-2026-46092

The affected component is the rtw88_pci kernel module, which drives Realtek 8821CE 802.11ac PCIe WiFi adapters, as identified by CPE cpe:2.3:o:linux:linux_kernel:*. The Linux PCI subsystem helper pci_upstream_bridge() is designed to return a pointer to the device's upstream bridge; however, per the kernel API contract, it returns NULL when the device is attached directly to the root PCI bus with no intervening PCI-to-PCI bridge. The rtw88 driver's probe routine passed this return value to a bridge-specific workaround path without first validating it for NULL, constituting a classic CWE-476 (NULL Pointer Dereference). The crash is triggered unconditionally during module load on affected topologies. The defect went undiscovered because 8821CE is predominantly bundled in laptops - where an upstream bridge is always present - and only manifests on desktops, mini-PCs, or embedded systems with flat PCI topologies. The kernel fix introduces a NULL guard before the workaround is applied, scoped to stable commits in the 5.15, 5.16, and 5.17 stable trees.