EUVD-2026-59559
GHSA-r36v-qwfg-3x64
Severity by source
AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
AV:A confirmed by Wi-Fi driver context; AC raised to H because triggering PCIe AER remotely requires inducing hardware-level error conditions, not a simple network request.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
wifi: rtw88: fix wrong pci_get_drvdata type in AER handlers
rtw88 stores an ieee80211_hw pointer via pci_set_drvdata() at probe time, but io_error_detected() and io_resume() retrieve it as a net_device pointer. This causes netif_device_detach/attach to operate on an ieee80211_hw struct, reading and writing at wrong offsets.
Use ieee80211_stop_queues/wake_queues instead, consistent with every other queue stop/start path in the driver.
AnalysisAI
Type confusion in the rtw88 Realtek PCIe Wi-Fi driver's PCI Advanced Error Reporting (AER) handlers allows an adjacent-network attacker to corrupt kernel memory, potentially enabling privilege escalation or arbitrary kernel code execution on Linux systems using Realtek PCIe Wi-Fi hardware. The driver stores an ieee80211_hw pointer via pci_set_drvdata() at probe time but retrieves it as a net_device pointer in io_error_detected() and io_resume(), causing netif operations to read and write kernel memory at incorrect struct offsets. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the target to: (1) run a Linux kernel version between the introducing commit cdb82c80b9349ed1d9ce6b49856128e04f4effc9 and the fix commits for the respective stable series; (2) have a Realtek PCIe Wi-Fi adapter supported by the rtw88 driver loaded and operational (USB-connected Realtek adapters using rtw88_usb are not affected by this AER path); (3) have PCIe Advanced Error Reporting (AER) enabled in the kernel, which is the default when the hardware supports it. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor-assigned CVSS of 8.8 (AV:A/AC:L/PR:N/UI:N/C:H/I:H/A:H) reflects a high-severity adjacent-network vector with no authentication requirement and full kernel-level impact, but several signals temper real-world urgency. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker within Wi-Fi radio range of a Linux system equipped with a Realtek PCIe Wi-Fi adapter sends crafted 802.11 frames or uses RF manipulation to induce error conditions on the underlying PCIe hardware, triggering the kernel's PCIe AER error recovery path. The AER callback io_error_detected() retrieves the stored driver pointer and misinterprets it as a net_device, causing netif_device_detach() to read and write kernel memory at incorrect offsets within the ieee80211_hw allocation. … |
| Remediation | The primary remediation is to upgrade the Linux kernel to version 6.18.40 or 7.1.5 (or 7.2-rc1 and later), which contain the upstream fix. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all Linux systems using the rtw88 Realtek driver through automated inventory tools or manual verification. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today