Skip to main content
cve.nowby Sazabi
← All vulnerabilities
CVE-2026-43213

wifi: rtw89: pci: validate sequence number of TX release report

The Linux kernel rtw89 PCI Wi-Fi driver is affected from 5.16.0 until fixed in 6.6.160, 6.12.114, 6.18.16, or 6.19.6, depending on branch. The fix validates the sequence number of TX release reports.

Published
Last modified
published
Not listed in CISA KEV
Unclear
Fix
Fixed in 6.6.160, 6.12.114, 6.18.16, 6.19.6
None on Exploit-DB, Metasploit or GitHub
  • Exploitation: none
  • Automatable: no
  • Technical impact: total

Summary

In the Linux kernel, the following vulnerability has been resolved: wifi: rtw89: pci: validate sequence number of TX release report Hardware rarely reports abnormal sequence number in TX release report, which will access out-of-bounds of wd_ring->pages array, causing NULL pointer dereference. BUG: kernel NULL pointer dereference, address: 0000000000000000 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 0 P4D 0 Oops: 0000 [#1] PREEMPT SMP NOPTI CPU: 1 PID: 1085 Comm: irq/129-rtw89_p Tainted: G S U 6.1.145-17510-g2f3369c91536 #1 (HASH:69e8 1) Call Trace: <IRQ> rtw89_pci_release_tx+0x18f/0x300 [rtw89_pci (HASH:4c83 2)] rtw89_pci_napi_poll+0xc2/0x190 [rtw89_pci (HASH:4c83 2)] net_rx_action+0xfc/0x460 net/core/dev.c:6578 net/core/dev.c:6645 net/core/dev.c:6759 handle_softirqs+0xbe/0x290 kernel/softirq.c:601 ? rtw89_pci_interrupt_threadfn+0xc5/0x350 [rtw89_pci (HASH:4c83 2)] __local_bh_enable_ip+0xeb/0x120 kernel/softirq.c:499 kernel/softirq.c:423 </IRQ> <TASK> rtw89_pci_interrupt_threadfn+0xf8/0x350 [rtw89_pci (HASH:4c83 2)] ? irq_thread+0xa7/0x340 kernel/irq/manage.c:0 irq_thread+0x177/0x340 kernel/irq/manage.c:1205 kernel/irq/manage.c:1314 ? thaw_kernel_threads+0xb0/0xb0 kernel/irq/manage.c:1202 ? irq_forced_thread_fn+0x80/0x80 kernel/irq/manage.c:1220 kthread+0xea/0x110 kernel/kthread.c:376 ? synchronize_irq+0x1a0/0x1a0 kernel/irq/manage.c:1287 ? kthread_associate_blkcg+0x80/0x80 kernel/kthread.c:331 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295 </TASK> To prevent crash, validate rpp_info.seq before using.

Timeline

  1. CVE published
  2. CISA SSVC assessment

    Exploitation: none · Automatable: no · Technical impact: total

  3. Record last updated

Affected versions

  • Linux Linux

    Version range not reported

  • Linux Linux

    5.16

  • KernelLinux

    From 5.16.0 · fixed in 6.6.160; From 6.7.0 · fixed in 6.12.114; From 6.13.0 · fixed in 6.18.16; From 6.19.0 · fixed in 6.19.6

References 6

git.kernel.org

FAQ

Questions about CVE-2026-43213

What does this mean?

When the Wi-Fi hardware reports an abnormal sequence number in a TX release report, the driver accesses the wd_ring->pages array out of bounds. This can cause a kernel NULL pointer dereference and a crash.Source: git.kernel.org

Am I affected, and how do I check?

Affected kernels are those from 5.16.0 up to the fixed releases for each branch: 6.6.160, 6.12.114, 6.18.16, and 6.19.6. The issue is in the rtw89 PCI Wi-Fi driver, and the hardware condition is rare. To check a system, run uname -r to see the kernel version and whether the rtw89 PCI driver is loaded.Source: git.kernel.org

What should I do about it?

Update to the fixed kernel for your branch: 6.6.160, 6.12.114, 6.18.16, or 6.19.6, or a later release in that series.Source: git.kernel.org

Is it being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.Source: cve.now feed data