CVE-2026-74410

A flaw was found in the Linux kernel's rtw88 wifi driver. An attacker able to control firmware RX descriptors could cause an out-of-bounds read from the pre-allocated Direct Memory Access (DMA) buffer. This occurs because the new_len calculation in the rtw_pci_rx_napi() function does not properly validate the size of incoming data against the buffer.

An OOB read in the rtw88 PCIe RX path can occur because rtw_pci_rx_napi() computes new_len from pkt_len plus pkt_offset without checking it against RTK_PCI_RX_BUF_SIZE. These fields come from the firmware RX descriptor and can make skb_put_data copy more bytes than the pre allocated DMA RX buffer contains. For the CVSS the PR:N is used because a plausible external trigger does not require local privileges on the target system. The attack surface is adjacent network Wi-Fi rather than general Internet reachability, so AV:A is used. Impact is at least denial of service via kernel crash or fault and may include confidentiality impact from reading beyond the RX buffer. No direct OOB write or privilege escalation primitive is shown by the patch context.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.