What is the CVSS score of CVE-2026-74411?

CVE-2026-74411 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Linux Kernel rtw89 are affected by CVE-2026-74411?

The Linux rtw89 driver for Realtek RTW89 802.11ax Wi-Fi chipsets contains an integer truncation vulnerability that causes kernel panics when scanning 6GHz networks, risking system unavailability and…. A patch is available.

How to fix or mitigate CVE-2026-74411?

Within 24 hours, inventory all Linux systems with Realtek RTW89 802.11ax Wi-Fi hardware to determine scope and criticality. Within 7 days, coordinate with infrastructure teams to stage and schedule application of the vendor-released Linux rtw89 driver patch, prioritizing production systems. Within 30 days, complete patch deployment across all affected systems and validate through testing that 6GHz network scanning no longer triggers kernel panics.

Linux Kernel rtw89 CVE-2026-74411

EUVD-2026-59558 HIGH

2026-08-15 Linux

GHSA-75cw-hg5p-hxfv

Denial Of Service Linux Red Hat

8.8

CVSS 3.1 · Vendor: Linux

Severity by source

Vendor (Linux) PRIMARY

8.8 HIGH

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

6.5 MEDIUM

Adjacent attacker with rogue AP; pure DoS impact (kernel panic only); no confidentiality or integrity compromise demonstrated.

3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Red Hat

5.5 MEDIUM

qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 17, 2026 - 11:12 vuln.today

CVSS changed

Aug 17, 2026 - 06:22 NVD

8.8 (HIGH)

Patch available

Aug 15, 2026 - 07:19 EUVD

CVE Published

Aug 15, 2026 - 05:59 cve.org

HIGH 8.8

CVE Published

Aug 15, 2026 - 05:59 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

wifi: rtw89: Correct data type for scan index to avoid infinite loop

A kernel soft lockup was observed during Wi-Fi scanning on the 6GHz band. The CPU becomes stuck in rtw89_hw_scan_add_chan_ax for over 20 seconds, leading to a system panic.

RIP points to 0f b6 c3 (movzbl %bl, %eax), which zero-extends the low 8 bits of RBX into RAX. RBX (the counter i) has reached a huge value: 0x137466a1.

watchdog: BUG: soft lockup - CPU#2 stuck for 26s! [kworker/u16:4:6124] Workqueue: events_unbound cfg80211_wiphy_work [cfg80211] RIP: 0010:rtw89_hw_scan_add_chan_ax+0xb3/0x6e0 [rtw89_core] Code: a0 48 89 45 a8 44 89 6d 9c 44 89 75 98 eb 29 66 66 2e 0f 1f 84 00 00 00 00 00 66 66 2e 0f 1f 84 00 00 00 00 00 66 90 83 c3 01 <0f> b6 c3 41 3b 44 24 74 0f 83 0b 02 00 00 0f b6 c3 48 8d 14 80 49 RSP: 0018:ffffcb48cbaa39f8 EFLAGS: 00000202 RAX: 0000000000000005 RBX: 00000000137466a1 RCX: 0000000000000000 RDX: ffff89ffc9d851a8 RSI: 0000000000004f0d RDI: 0000000096af0130 RBP: ffffcb48cbaa3a60 R08: 0000000000000000 R09: ffff8a00b7502080 R10: ffff8a00b75ff600 R11: 0000000000000000 R12: ffff89ffc7553870 R13: ffff8a00b7ac8f19 R14: ffff8a00b75020d8 R15: ffff89ffc3d54d80 FS: 0000000000000000(0000) GS:ffff8a014f962000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007558d7f9f4c4 CR3: 0000000178040001 CR4: 00000000001706f0 Call Trace: <TASK> rtw89_hw_scan_prep_chan_list_ax+0x8a/0x400 [rtw89_core] rtw89_hw_scan_start+0x546/0x8a0 [rtw89_core] ? rtw89_fw_h2c_default_cmac_tbl+0x13c/0x1f0 [rtw89_core] rtw89_ops_hw_scan+0xae/0x120 [rtw89_core] drv_hw_scan+0xbb/0x180 [mac80211] __ieee80211_start_scan+0x2fc/0x750 [mac80211] ieee80211_request_scan+0xe/0x20 [mac80211] ieee80211_scan+0x123/0x190 [mac80211] rdev_scan+0x40/0x110 [cfg80211] cfg80211_scan_6ghz+0x5a1/0xa30 [cfg80211]

By objdump with source:

for (i = 0; i < req->n_6ghz_params; i++) { 5fbc0: 83 c3 01 add $0x1,%ebx --> i++ 5fbc3: 0f b6 c3 movzbl %bl,%eax --> get counter fbc6: 41 3b 44 24 74 cmp 0x74(%r12),%eax

RBX: 00000000137466a1 -> %bl = a1 -> EAX = 000000a1 (161)

AnalysisAI

Kernel soft lockup and system panic in the Linux rtw89 Wi-Fi driver affects systems with Realtek RTW89 802.11ax chipsets during 6GHz band scanning. The root cause is an integer truncation bug where the loop counter variable i is silently narrowed to 8 bits via a movzbl %bl, %eax instruction; when req->n_6ghz_params exceeds 255, the counter wraps to zero and the loop never terminates, trapping the CPU for 26+ seconds until the watchdog fires and triggers a kernel panic. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Deploy rogue 802.11 AP within Wi-Fi range

Delivery

Broadcast beacon with >255 6GHz RNR entries

Exploit

Victim rtw89 driver processes malformed scan request

Execution

8-bit counter i wraps at 255, loop never exits

Persist

CPU soft lockup after 26 seconds

Impact

Kernel watchdog triggers system panic

Access

Deploy rogue 802.11 AP within Wi-Fi range

Delivery

Broadcast beacon with >255 6GHz RNR entries

Exploit

Victim rtw89 driver processes malformed scan request

Execution

8-bit counter i wraps at 255, loop never exits

Persist

CPU soft lockup after 26 seconds

Impact

Kernel watchdog triggers system panic

Vulnerability AssessmentAI

Exploitation	Exploitation requires: (1) the target system must be equipped with Realtek RTW89-family 802.11ax Wi-Fi hardware and have the rtw89_core kernel module loaded; (2) the attacker must be physically adjacent - within Wi-Fi radio range - and control or simulate an 802.11 access point capable of broadcasting beacons containing more than 255 6GHz RNR (Reduced Neighbor Report) channel entries; (3) the victim system must initiate or respond to a 6GHz band Wi-Fi scan while the malicious AP is in range. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The provided CVSS vector CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (8.8) includes C:H and I:H impact ratings that are not supported by the CVE description or available evidence - the demonstrated impact is exclusively a kernel DoS (soft lockup and panic). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker deploys a rogue 802.11 access point within Wi-Fi range of a target Linux laptop equipped with a Realtek RTW89 chipset, configuring the AP's beacons to advertise a large number (greater than 255) of 6GHz Reduced Neighbor Report elements. When the victim device initiates a Wi-Fi scan - automatically or user-triggered - the rtw89 driver processes the crafted scan parameters, the 8-bit counter wraps, and the CPU becomes trapped in an infinite loop for over 26 seconds before the kernel watchdog triggers a system panic and crash. …
Remediation	The primary fix is to upgrade to a patched kernel version: 6.6.145, 6.12.97, 6.18.40, 7.1.5, or 7.2-rc1 and later, as confirmed by EUVD-2026-59558 and the upstream stable commits at https://git.kernel.org/stable/c/966fbed4b4463fbcb49c5becf3f86eae776861bd and related hashes. … Detailed patch versions, workarounds, and compensating controls in full report.