CVE-2026-74409

A flaw was found in the Realtek rtw89 Wi-Fi driver in the Linux kernel. This vulnerability arises from insufficient validation of the mac_id field, which is received from firmware and used as an array index. An attacker could potentially craft malicious firmware to provide an out-of-range mac_id, leading to an out-of-bounds read. This could result in memory corruption or a denial of service.

The rtw89 driver used the firmware supplied mac_id from RX descriptors as an index into assoc_link_on_macid without checking it against RTW89_MAX_MAC_ID_NUM. The descriptor field is 8 bit while the array has only 128 entries, so an out-of-range firmware value can cause an out-of-bounds read of a kernel pointer and may later lead to an invalid pointer dereference in the RX path. For the CVSS the PR:N is used for the paranoid score because an adjacent WiFi attacker would not need local code execution or credentials on the victim if the invalid mac_id can be induced through received traffic or firmware behavior. The issue is not Internet reachable, but it may be reachable from the local WiFi radio range on affected Realtek rtw89 devices. Impact is at least denial of service via driver or kernel crash. In worst case it may allow limited confidentiality or integrity impact because the bug reads a pointer outside the intended array and can feed that value into later driver logic.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.