CVE-2026-74410

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-74410
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-74410.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-74410
Downstream
Published
2026-08-15T05:59:18.039Z
Modified
2026-08-16T03:48:35.164810922Z
Summary
wifi: rtw88: fix OOB read from firmware RX descriptor exceeding DMA buffer
Details

In the Linux kernel, the following vulnerability has been resolved:

wifi: rtw88: fix OOB read from firmware RX descriptor exceeding DMA buffer

In rtwpcirxnapi(), newlen is computed as the sum of pktlen (14-bit descriptor field, max 16383) and pktoffset (drvinfosz + shift, both firmware-controlled). The result can exceed RTKPCIRXBUFSIZE (11478), causing an out-of-bounds read from the pre-allocated DMA buffer when skbputdata copies newlen bytes. The USB transport already validates this (rtwusbrxdataput checks against RTWUSBMAXRECVBUF_SZ); the PCIe path does not.

Add a check that new_len does not exceed the DMA buffer size.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/74xxx/CVE-2026-74410.json",
    "cna_assigner": "Linux"
}
References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
e3037485c68ec1a299ff41160d8fedbd4abc29b9
Fixed
913bd7d3d3d842b5c1d2b908a0201efa8fc79793
Fixed
45abc14ab3f15da7d689f1a8809c1a01240a94d9
Fixed
08193e733e5d4790e6c937af86d78793b02709be
Fixed
6a3c384393d3f0b41669ed5a2e88744aad9d87c8
Fixed
26c183a86ea4dd1f2ff90c6f783649e7f5722a10
Fixed
01155ded5d4dad61840a9a3c33ab56778ef1f100
Fixed
1554fa522f16ec7c5c342ad33fe734eeb6eb2452
Fixed
6e76e9ed273dfb4b3333a5ebbb94958cc5752ab6

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-74410.json"

Linux / Kernel

Package

Name
Kernel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
5.2.0
Fixed
5.10.261
Type
ECOSYSTEM
Events
Introduced
5.11.0
Fixed
5.15.212
Type
ECOSYSTEM
Events
Introduced
5.16.0
Fixed
6.1.178
Type
ECOSYSTEM
Events
Introduced
6.2.0
Fixed
6.6.145
Type
ECOSYSTEM
Events
Introduced
6.7.0
Fixed
6.12.97
Type
ECOSYSTEM
Events
Introduced
6.13.0
Fixed
6.18.40
Type
ECOSYSTEM
Events
Introduced
6.19.0
Fixed
7.1.5

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-74410.json"