CVE-2026-74413

A flaw was found in the rtw89 Wi-Fi driver in the Linux kernel. The driver's Advanced Error Reporting (AER) handlers incorrectly use a net_device pointer type instead of an ieee80211_hw pointer type. This leads to operations on incorrect memory offsets, which can result in system instability or a denial of service.

rtw89 PCI AER handlers used pci_get_drvdata as if it returned a net_device pointer, while probe stored an ieee80211_hw pointer. As a result, netif_device_detach and netif_device_attach could read and write wrong offsets in the ieee80211_hw object during PCI error recovery. This is a type confusion and wrong-object access in kernel context, with a practical impact of driver state corruption or kernel crash. For the CVSS the PR:L is used for the paranoid score because some deployments may allow a reduced capability local actor, service account, or delegated recovery path to trigger PCI error recovery, while the normal base case is closer to PR:H. The issue is not directly network reachable and normally depends on PCIe AER injection, reset/error recovery control, or a real device fault. Impact is at least local denial of service via kernel crash, and in worst case may allow limited confidentiality or integrity impact due to kernel memory corruption and should be reviewed manually.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.