EUVD-2026-59560
GHSA-cq4j-9r28-wxqg
Severity by source
AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
AV:A is correct for WiFi-range triggering; AC:H reflects the non-trivial requirement of inducing a PCIe AER event via crafted frames; primary impact is kernel crash (A:H), with limited and difficult-to-control read/write at wrong offsets (C:L/I:L).
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
wifi: rtw89: fix wrong pci_get_drvdata type in AER handlers
rtw89 stores an ieee80211_hw pointer via pci_set_drvdata() at probe time, but io_error_detected() and io_resume() retrieve it as a net_device pointer. This causes netif_device_detach/attach to operate on an ieee80211_hw struct, reading and writing at wrong offsets. The adjacent io_slot_reset() already does it correctly.
Use ieee80211_stop_queues/wake_queues instead, consistent with every other queue stop/start path in the driver.
Tested on RTL8852CE by calling the handlers from a test module before and after the fix.
AnalysisAI
Type confusion in the rtw89 PCI Advanced Error Reporting (AER) handlers corrupts kernel memory on Linux systems equipped with Realtek RTL8852CE and related WiFi adapters. The driver stores an ieee80211_hw pointer via pci_set_drvdata() at probe time, but io_error_detected() and io_resume() incorrectly retrieve it as a net_device pointer, causing netif_device_detach/attach to read and write at wrong memory offsets within a misidentified kernel struct. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the target system to be running a Linux kernel between commit 16e3d93c6183649a3b210f82b83c1cb12aa5e8a3 and the respective fix commits, with an RTL8852CE (or compatible rtw89-supported) Realtek PCIe WiFi adapter physically present and the rtw89_pci kernel module loaded and bound to that hardware. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The NVD CVSS 3.1 vector (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H = 8.8) attributes high confidentiality, integrity, and availability impact with adjacent-network reachability and no authentication. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker positioned within WiFi radio range of a Linux laptop or workstation equipped with an RTL8852CE adapter crafts 802.11 management or data frames designed to cause the Realtek PCIe chip to assert a PCIe AER error condition. The kernel's PCIe AER subsystem invokes io_error_detected() in the rtw89 driver, which retrieves the stored ieee80211_hw pointer but treats it as a net_device pointer, causing netif_device_detach() to operate at wrong memory offsets within the kernel ieee80211_hw struct. … |
| Remediation | The primary fix is to upgrade the Linux kernel to a patched release: 6.18.40, 7.1.5, or 7.2-rc1 (or later). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: conduct an inventory of Linux systems using Realtek RTL8852CE adapters to determine organizational attack surface. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today