From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 37A1438735E for ; Sat, 15 Aug 2026 06:39:22 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786775963; cv=none; b=Tz5MZrT9iotbEpHw8s0hxndPXvGvc3runNXHwKSqXGATys2AGz4MFErg0d+MZLBwtXHLxZ2klGXXrhtaNegMiW6AEE+wlWkG/mUUgauXAL2MLx9b6RyoQqO0FiNII8Sh3/G0yoGiS6h1n7HXq9IqAl8UyM8ct9gaKbiT3mCVWdY= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786775963; c=relaxed/simple; bh=Vm07ci7jHU/W5Vy6n+UcwZ0id76l77Udc0NoeTHKGrs=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=O0Eqq7UsL/GMozvH6FVa6HLlxvVKX0jPJ0KEt735PkXPXgqMRco+yo/fDq9s0M1mEX31LAnHr1tLUfb6cZGPZXH0f9HwiLaY+OdgA/rCbykpIRRD+yrUFVP+6LQZHZ6lYoW5VZV1u3FqS7BTCnKOhVQW/950GB69gbAh9ZqDIx0= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=Fub9cZw4; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="Fub9cZw4" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 8BB261F000E9; Sat, 15 Aug 2026 06:39:21 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1786775962; bh=d+FOq6Re3nRosPEbLd12yPIWHU5a2ti8FUzW8Uo5ygI=; h=From:To:Cc:Subject:Date:Reply-To; b=Fub9cZw4AqEYMCzzUJb6D4fCC2cxQOUq9VE7eHKyYW3LSY8POVMYN8S3hp7d2XCzQ rDbwBwjXceHHt0c3YAQYEaaC5t0iQz0Lr7NuF6RYX8cl5bz4DwqOGqkRzclTxbsl7T qiO3ZV0Kp9WKv0XaTx5grDB69EwXOa8460OdOdqA= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2026-74412: wifi: rtw88: fix wrong pci_get_drvdata type in AER handlers Date: Sat, 15 Aug 2026 15:12:19 +0900 Message-ID: <2026081511-CVE-2026-74412-513f@gregkh> X-Mailer: git-send-email 2.55.0 Reply-To: , Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=2400; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=9wJmkKtyjTxxKwZnE02D88xYcwkV4a61fwgqfK4kfT4=; b=owGbwMvMwCRo6H6F97bub03G02pJDFkNjPJG87b37a7fZ18mHz4tjE9RYp6sij3HqSP68xdGF L79/+JlRywLgyATg6yYIsuXbTxH91ccUvQytD0NM4eVCWQIAxenAEzk8wyG+a4szbNnxC9XEKmv mbFz9xzRrJWpLQzzFCYoRHTuX/k86lAv32keS8ckXsPTAA== X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit From: Greg Kroah-Hartman Description =========== In the Linux kernel, the following vulnerability has been resolved: wifi: rtw88: fix wrong pci_get_drvdata type in AER handlers rtw88 stores an ieee80211_hw pointer via pci_set_drvdata() at probe time, but io_error_detected() and io_resume() retrieve it as a net_device pointer. This causes netif_device_detach/attach to operate on an ieee80211_hw struct, reading and writing at wrong offsets. Use ieee80211_stop_queues/wake_queues instead, consistent with every other queue stop/start path in the driver. The Linux kernel CVE team has assigned CVE-2026-74412 to this issue. Affected and fixed versions =========================== Issue introduced in 6.17 with commit cdb82c80b9349ed1d9ce6b49856128e04f4effc9 and fixed in 6.18.40 with commit 1ef3d1338d94ec41f58fbfb6ba7742a27ea61d89 Issue introduced in 6.17 with commit cdb82c80b9349ed1d9ce6b49856128e04f4effc9 and fixed in 7.1.5 with commit d7920797f721f944861f3c48ffb2b73f84b631fe Issue introduced in 6.17 with commit cdb82c80b9349ed1d9ce6b49856128e04f4effc9 and fixed in 7.2-rc1 with commit 706183dbef4a79d120d4e928f693bea50df496f8 Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2026-74412 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: drivers/net/wireless/realtek/rtw88/pci.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/1ef3d1338d94ec41f58fbfb6ba7742a27ea61d89 https://git.kernel.org/stable/c/d7920797f721f944861f3c48ffb2b73f84b631fe https://git.kernel.org/stable/c/706183dbef4a79d120d4e928f693bea50df496f8