CVE-2026-74412

A flaw was found in the rtw88 Wi-Fi driver within the Linux kernel. This vulnerability arises from a type confusion during PCI Advanced Error Reporting (AER) handling, where a hardware-related pointer is mistakenly interpreted as a network device pointer. This misinterpretation causes the driver to perform operations on incorrect memory locations, leading to memory corruption. Such an issue can result in system instability or a denial of service.

The rtw88 PCI AER handlers retrieved pci driver data as a net_device pointer even though probe stored an ieee80211_hw pointer. As a result, netif_device_detach and netif_device_attach could operate on the wrong object type and access fields at net_device offsets inside an ieee80211_hw object. This is a kernel type confusion bug with wrong offset reads and writes, so the impact is at least a local denial of service via crash or corrupted driver state and in the worst case may allow broader memory corruption. For the CVSS the PR:L in the paranoid score reflects environments where a local low privileged process can indirectly trigger PCI error recovery or device recovery through exposed management paths, while the base score keeps PR:H for typical systems where AER injection and driver reset control are administrative. The issue is not directly network reachable from normal WiFi traffic and exploitation requires reaching the PCIe error recovery path for an affected rtw88 device.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.