CVE-2026-43176 (GCVE-0-2026-43176)
Vulnerability from cvelistv5
Published
2026-05-06 11:27
Modified
2026-10-19 19:16
Severity ?
8.8 (High) - CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: wifi: rtw89: pci: validate release report content before using for RTL8922DE The commit 957eda596c76 ("wifi: rtw89: pci: validate sequence number of TX release report") does validation on existing chips, which somehow a release report of SKB becomes malformed. As no clear cause found, add rules ahead for RTL8922DE to avoid crash if it happens.
References
Impacted products
Vendor Product Version
Linux Linux Version: 110f3c11f440d78ef8a181f75456e24e428f69e4
Version: 110f3c11f440d78ef8a181f75456e24e428f69e4
Version: 110f3c11f440d78ef8a181f75456e24e428f69e4
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-43176",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-16T15:15:20.006186Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-20",
                "description": "CWE-20 Improper Input Validation",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-19T19:16:22.766Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wireless/realtek/rtw89/pci.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "ebeaa3b24ba568ff8505165f954dba15cc53e4b3",
              "status": "affected",
              "version": "110f3c11f440d78ef8a181f75456e24e428f69e4",
              "versionType": "git"
            },
            {
              "lessThan": "3e8a88b5e8b3506d9c5e031a65ba65ce9a0683a3",
              "status": "affected",
              "version": "110f3c11f440d78ef8a181f75456e24e428f69e4",
              "versionType": "git"
            },
            {
              "lessThan": "5f93d611b33a05bd03d6843c8efe8cb6a1992620",
              "status": "affected",
              "version": "110f3c11f440d78ef8a181f75456e24e428f69e4",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wireless/realtek/rtw89/pci.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.18"
            },
            {
              "lessThan": "6.18",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.16",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.16",
                  "versionStartIncluding": "6.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.6",
                  "versionStartIncluding": "6.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "6.18",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: rtw89: pci: validate release report content before using for RTL8922DE\n\nThe commit 957eda596c76\n(\"wifi: rtw89: pci: validate sequence number of TX release report\")\ndoes validation on existing chips, which somehow a release report of SKB\nbecomes malformed. As no clear cause found, add rules ahead for RTL8922DE\nto avoid crash if it happens."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:A - The vulnerable path is in a PCI WiFi driver\u2019s TX release-report handling, reached from device/firmware reports generated during wireless operation. A plausible attacker is an adjacent WiFi peer/AP/injector that can induce wireless traffic and repeated TX completions on affected RTL8922DE systems.\nAC:L - No race or special software privilege gate is required once the affected device is operating; the vulnerable report parser is reached through normal IRQ/NAPI processing. Although malformed reports are hardware/firmware-originated, repeated induced traffic makes low complexity the higher-severity defensible choice.\nPR:N - The path is entered from hardware interrupt/NAPI processing, not from an ioctl or privileged local API. An adjacent attacker does not need Linux credentials or kernel capabilities on the victim.\nUI:N - After the affected WiFi device is active, processing release reports requires no victim action at exploit time. The interrupt-driven reclaim path runs automatically.\nS:U - The impact is within the same host kernel/driver security authority. There is no VM escape, IOMMU bypass, or separate security scope crossed.\nC:H - The invalid TX channel can index outside or into unallocated `rtwpci-\u003etx.rings` entries before list/SKB operations, creating kernel memory corruption potential beyond a pure NULL dereference. Under the required uncertainty rule, this is scored as high confidentiality impact.\nI:H - The same unvalidated channel selection can drive list manipulation and cleanup on an invalid/uninitialized TX ring, which is memory corruption with potential control-flow or data integrity impact. Under the required uncertainty rule, this is scored as high integrity impact.\nA:H - The related release-report bug is documented to cause a kernel NULL pointer dereference/oops in this reclaim path, and this fix explicitly prevents crashes from malformed reports. A remotely induced kernel crash is high availability impact."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:26:18.965Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/ebeaa3b24ba568ff8505165f954dba15cc53e4b3"
        },
        {
          "url": "https://git.kernel.org/stable/c/3e8a88b5e8b3506d9c5e031a65ba65ce9a0683a3"
        },
        {
          "url": "https://git.kernel.org/stable/c/5f93d611b33a05bd03d6843c8efe8cb6a1992620"
        }
      ],
      "title": "wifi: rtw89: pci: validate release report content before using for RTL8922DE",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-43176",
    "datePublished": "2026-05-06T11:27:50.150Z",
    "dateReserved": "2026-05-01T14:12:55.991Z",
    "dateUpdated": "2026-10-19T19:16:22.766Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-43176\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-10-16T15:15:20.006186Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-20\", \"description\": \"CWE-20 Improper Input Validation\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-10-16T15:15:20.575Z\"}}], \"cna\": {\"title\": \"wifi: rtw89: pci: validate release report content before using for RTL8922DE\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 8.8, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:A - The vulnerable path is in a PCI WiFi driver\\u2019s TX release-report handling, reached from device/firmware reports generated during wireless operation. A plausible attacker is an adjacent WiFi peer/AP/injector that can induce wireless traffic and repeated TX completions on affected RTL8922DE systems.\\nAC:L - No race or special software privilege gate is required once the affected device is operating; the vulnerable report parser is reached through normal IRQ/NAPI processing. Although malformed reports are hardware/firmware-originated, repeated induced traffic makes low complexity the higher-severity defensible choice.\\nPR:N - The path is entered from hardware interrupt/NAPI processing, not from an ioctl or privileged local API. An adjacent attacker does not need Linux credentials or kernel capabilities on the victim.\\nUI:N - After the affected WiFi device is active, processing release reports requires no victim action at exploit time. The interrupt-driven reclaim path runs automatically.\\nS:U - The impact is within the same host kernel/driver security authority. There is no VM escape, IOMMU bypass, or separate security scope crossed.\\nC:H - The invalid TX channel can index outside or into unallocated `rtwpci-\u003etx.rings` entries before list/SKB operations, creating kernel memory corruption potential beyond a pure NULL dereference. Under the required uncertainty rule, this is scored as high confidentiality impact.\\nI:H - The same unvalidated channel selection can drive list manipulation and cleanup on an invalid/uninitialized TX ring, which is memory corruption with potential control-flow or data integrity impact. Under the required uncertainty rule, this is scored as high integrity impact.\\nA:H - The related release-report bug is documented to cause a kernel NULL pointer dereference/oops in this reclaim path, and this fix explicitly prevents crashes from malformed reports. A remotely induced kernel crash is high availability impact.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"110f3c11f440d78ef8a181f75456e24e428f69e4\", \"lessThan\": \"ebeaa3b24ba568ff8505165f954dba15cc53e4b3\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"110f3c11f440d78ef8a181f75456e24e428f69e4\", \"lessThan\": \"3e8a88b5e8b3506d9c5e031a65ba65ce9a0683a3\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"110f3c11f440d78ef8a181f75456e24e428f69e4\", \"lessThan\": \"5f93d611b33a05bd03d6843c8efe8cb6a1992620\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/net/wireless/realtek/rtw89/pci.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"6.18\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"6.18\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.18.16\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.18.*\"}, {\"status\": \"unaffected\", \"version\": \"6.19.6\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.19.*\"}, {\"status\": \"unaffected\", \"version\": \"7.0\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/net/wireless/realtek/rtw89/pci.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/ebeaa3b24ba568ff8505165f954dba15cc53e4b3\"}, {\"url\": \"https://git.kernel.org/stable/c/3e8a88b5e8b3506d9c5e031a65ba65ce9a0683a3\"}, {\"url\": \"https://git.kernel.org/stable/c/5f93d611b33a05bd03d6843c8efe8cb6a1992620\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nwifi: rtw89: pci: validate release report content before using for RTL8922DE\\n\\nThe commit 957eda596c76\\n(\\\"wifi: rtw89: pci: validate sequence number of TX release report\\\")\\ndoes validation on existing chips, which somehow a release report of SKB\\nbecomes malformed. As no clear cause found, add rules ahead for RTL8922DE\\nto avoid crash if it happens.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.18.16\", \"versionStartIncluding\": \"6.18\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.19.6\", \"versionStartIncluding\": \"6.18\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"7.0\", \"versionStartIncluding\": \"6.18\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T12:26:18.965Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-43176\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-10-19T19:16:22.766Z\", \"dateReserved\": \"2026-05-01T14:12:55.991Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2026-05-06T11:27:50.150Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.