CVE-2026-74409 wifi: rtw89: add bounds check on firmware mac_id in link lookup

In the Linux kernel, the following vulnerability has been resolved: wifi: rtw89: add bounds check on firmware macid in link lookup The macid field in RX descriptors is 8 bits wide 0-255, but assoclinkonmacid has only RTW89MAXMACIDNUM 128 entries. While the driver currently assigns macid values...

CVE-2026-74409

Summary : The CVE-2026-74409 issue resides in the Linux kernel wifi driver for RTW89. An 8‑bit mac_id in RX descriptors (0–255) can index into assoc_link_on_macid[] which has only 128 entries (RTW89_MAX_MAC_ID_NUM). Firmware-supplied mac_id values are not validated before use as an array index, a...

EUVD-2026-59556

In the Linux kernel, the following vulnerability has been resolved: wifi: rtw89: add bounds check on firmware macid in link lookup The macid field in RX descriptors is 8 bits wide 0-255, but assoclinkonmacid has only RTW89MAXMACIDNUM 128 entries. While the driver currently assigns macid values...

CVE-2026-74409 wifi: rtw89: add bounds check on firmware mac_id in link lookup

In the Linux kernel, the following vulnerability has been resolved: wifi: rtw89: add bounds check on firmware macid in link lookup The macid field in RX descriptors is 8 bits wide 0-255, but assoclinkonmacid has only RTW89MAXMACIDNUM 128 entries. While the driver currently assigns macid values...

PT-2026-72849

In the Linux kernel, the following vulnerability has been resolved: wifi: rtw89: fix wrong pci get drvdata type in AER handlers rtw89 stores an ieee80211 hw pointer via pci set drvdata at probe time, but io error detected and io resume retrieve it as a net device pointer. This causes netif device...

PT-2026-72845

In the Linux kernel, the following vulnerability has been resolved: wifi: rtw89: add bounds check on firmware mac id in link lookup The mac id field in RX descriptors is 8 bits wide 0-255, but assoc link on macid has only RTW89 MAX MAC ID NUM 128 entries. While the driver currently assigns mac id...

PT-2026-72847

In the Linux kernel, the following vulnerability has been resolved: wifi: rtw89: Correct data type for scan index to avoid infinite loop A kernel soft lockup was observed during Wi-Fi scanning on the 6GHz band. The CPU becomes stuck in rtw89 hw scan add chan ax for over 20 seconds, leading to a...

CVE-2026-64506

In the Linux kernel, the following vulnerability has been resolved: wifi: rtw89: correct drop logic for malformed AMPDU frames The previous commit aims to fix issue caused by malformed AMPDU frames. But the drop logic fails to deal with the first AMPDU packet paired with certain range of sequence...

UBUNTU-CVE-2026-64506

In the Linux kernel, the following vulnerability has been resolved: wifi: rtw89: correct drop logic for malformed AMPDU frames The previous commit aims to fix issue caused by malformed AMPDU frames. But the drop logic fails to deal with the first AMPDU packet paired with certain range of sequence...

EUVD-2026-48850

In the Linux kernel, the following vulnerability has been resolved: wifi: rtw89: correct drop logic for malformed AMPDU frames The previous commit aims to fix issue caused by malformed AMPDU frames. But the drop logic fails to deal with the first AMPDU packet paired with certain range of sequence...

CVE-2026-64506

CVE-2026-64506 affects the Linux kernel wifi driver rtW89: a bug in the AMPDU drop logic could drop the first AMPDU packet when paired with certain sequence numbers, increasing the chance of disconnection from the AP during busy traffic or rekey. The fix adds an initial state judgement and resets...

CVE-2026-64506

In the Linux kernel, the following vulnerability has been resolved: wifi: rtw89: correct drop logic for malformed AMPDU frames The previous commit aims to fix issue caused by malformed AMPDU frames. But the drop logic fails to deal with the first AMPDU packet paired with certain range of sequence...

CVE-2026-64506 wifi: rtw89: correct drop logic for malformed AMPDU frames

In the Linux kernel, the following vulnerability has been resolved: wifi: rtw89: correct drop logic for malformed AMPDU frames The previous commit aims to fix issue caused by malformed AMPDU frames. But the drop logic fails to deal with the first AMPDU packet paired with certain range of sequence...

CVE-2026-64506

In the Linux kernel, the following vulnerability has been resolved: wifi: rtw89: correct drop logic for malformed AMPDU frames The previous commit aims to fix issue caused by malformed AMPDU frames. But the drop logic fails to deal with the first AMPDU packet paired with certain range of sequence...

Linux Distros Unpatched Vulnerability : CVE-2026-64506

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: wifi: rtw89: correct drop logic for malformed AMPDU frames The previous commit aims to fix...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: Wifi: rtw89 – fw: scan offload prohibit all 6 GHz channels if no 6 GHz sband exists. We have certain policies via the BIOS that prevent the use of 6 GHz frequencies. In this case, the 6 GHz sband parameter will be set to NULL, ev...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: Wifi: rtw89: sar: The assertion droplockdep in rtw89setsarfromacpi was removed. This assertion is triggered during the startup of the rtw89 driver. It seems meaningless to hold wiphy lock at the early initialization stage;...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: wifi: rtw89 – freed unused skb objects to prevent memory leaks. This prevents potential memory leaks under power-saving mode...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: Wifi: rtw89: Fix for soft lockup in rtw89entityrecalcmgntroles. During rtw89entityrecalcmgntroles, there is a normalization process that will reorder the list if an entry with the target pattern is found. Once such an entry is...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: Wifi: rtw89: pci: Configure manual DAC mode via PCI config API only To support 36-bit DMA, configure the chip’s proprietary bit via the PCI config API or the chip’s DBI interface. However, the PCI device’s mmap is not set yet, an...