26 matches found
PT-2026-98135
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A NULL pointer dereference exists in the rtw fw adaptivity result function within fw.c of the rtw88 wifi driver. The issue occurs because devices using the 8821CE chip do not define the...
DEBIAN-CVE-2026-80941
In the Linux kernel, the following vulnerability has been resolved: wifi: rtw88: Fix potential memory leak in rtwtxqpushskb The skb passed to the rtwhcitxwrite is expected to be freed when the function fails, but the error path in rtwtxqpushskb does not free the skb before returning. This can lea...
CVE-2026-80941
In the Linux kernel, the following vulnerability has been resolved: wifi: rtw88: Fix potential memory leak in rtwtxqpushskb The skb passed to the rtwhcitxwrite is expected to be freed when the function fails, but the error path in rtwtxqpushskb does not free the skb before returning. This can lea...
CVE-2026-80941
CVE-2026-80941 affects the Linux kernel wifi: rtw88 driver. The root cause is in rtw_txq_push_skb() : when the skb passed to rtw_hci_tx_write() fails, the error path does not free the skb before returning. This leads to a potential memory leak in rtw_txq_push() , where a dequeued skb is passed to...
EUVD-2026-76264
In the Linux kernel, the following vulnerability has been resolved: wifi: rtw88: Fix potential memory leak in rtwtxqpushskb The skb passed to the rtwhcitxwrite is expected to be freed when the function fails, but the error path in rtwtxqpushskb does not free the skb before returning. This can lea...
SUSE CVE-2026-74410
In the Linux kernel, the following vulnerability has been resolved: wifi: rtw88: fix OOB read from firmware RX descriptor exceeding DMA buffer In rtwpcirxnapi, newlen is computed as the sum of pktlen 14-bit descriptor field, max 16383 and pktoffset drvinfosz + shift, both firmware-controlled. The...
SUSE CVE-2026-74412
In the Linux kernel, the following vulnerability has been resolved: wifi: rtw88: fix wrong pcigetdrvdata type in AER handlers rtw88 stores an ieee80211hw pointer via pcisetdrvdata at probe time, but ioerrordetected and ioresume retrieve it as a netdevice pointer. This causes...
Unity Linux 20.1070e Security Update: kernel (UTSA-2025-001490)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-001490 advisory. In the Linux kernel, the following vulnerability has been resolved: wifi: rtw88: always wait for both firmware loading attempts In 'rtwwaitfirmwarecompletion', alway...
CVE-2026-46092
In the Linux kernel, the following vulnerability has been resolved: wifi: rtw88: check for PCI upstream bridge existence pciupstreambridge returns NULL if the device is on a root bus. If 8821CE is installed in the system with such a PCI topology, the probing routine will crash. This has probably...
EUVD-2026-32475
In the Linux kernel, the following vulnerability has been resolved: wifi: rtw88: check for PCI upstream bridge existence pciupstreambridge returns NULL if the device is on a root bus. If 8821CE is installed in the system with such a PCI topology, the probing routine will crash. This has probably...
CVE-2026-46092
CVE-2026-46092 relates to the Linux kernel's wifi rtw88 driver (8821CE) where pci_upstream_bridge() returns NULL for devices on a root bus, risking a crash during probe on certain PCI topologies. The fix is to explicitly check for the PCI upstream bridge before applying the workaround. A patch wa...
Azure Linux 3.0 Security Update: kernel (CVE-2025-38159)
"The version of kernel installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2025-38159 advisory. - In the Linux kernel, the following vulnerability has been resolved: wifi: rtw88: fix the 'para' buffer size...
CVE-2023-54071 wifi: rtw88: use work to update rate to avoid RCU warning
In the Linux kernel, the following vulnerability has been resolved: wifi: rtw88: use work to update rate to avoid RCU warning The ieee80211ops::starcupdate must be atomic, because ieee80211chanbwchange holds rcuread lock while calling drvstarcupdate, so create a work to do original things...
CVE-2023-54071 wifi: rtw88: use work to update rate to avoid RCU warning
In the Linux kernel, the following vulnerability has been resolved: wifi: rtw88: use work to update rate to avoid RCU warning The ieee80211ops::starcupdate must be atomic, because ieee80211chanbwchange holds rcuread lock while calling drvstarcupdate, so create a work to do original things...
PT-2025-53069
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The Linux kernel contains a flaw within the rtw88 wifi driver related to rate updates. The ieee80211 ops::sta rc update function must be atomic to prevent a context switch within an RCU...
Linux Distros Unpatched Vulnerability : CVE-2023-53529
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - wifi: rtw88: Fix memory leak in rtw88usb Kmemleak shows the following leak arising from routine in the usb probe routine: unreferenced object 0xffff895cb29bba00...
kernel: wifi: rtw88: fix the 'para' buffer size to avoid reading out of bounds
In the Linux kernel, the following vulnerability has been resolved: wifi: rtw88: fix the 'para' buffer size to avoid reading out of bounds Set the size to 6 instead of 2, since 'para' array is passed to 'rtwfwbtwificontrolrtwdev, para0, ¶1', which reads 5 bytes: void rtwfwbtwificontrolstruct...
kernel: wifi: rtw88: fix the 'para' buffer size to avoid reading out of bounds
In the Linux kernel, the following vulnerability has been resolved: wifi: rtw88: fix the 'para' buffer size to avoid reading out of bounds Set the size to 6 instead of 2, since 'para' array is passed to 'rtwfwbtwificontrolrtwdev, para0, ¶1', which reads 5 bytes: void rtwfwbtwificontrolstruct...
kernel: wifi: rtw88: fix the 'para' buffer size to avoid reading out of bounds
In the Linux kernel, the following vulnerability has been resolved: wifi: rtw88: fix the 'para' buffer size to avoid reading out of bounds Set the size to 6 instead of 2, since 'para' array is passed to 'rtwfwbtwificontrolrtwdev, para0, ¶1', which reads 5 bytes: void rtwfwbtwificontrolstruct...
AZL-64532 CVE-2025-38159 affecting package kernel for versions less than 6.6.96.1-1
In the Linux kernel, the following vulnerability has been resolved: wifi: rtw88: fix the 'para' buffer size to avoid reading out of bounds Set the size to 6 instead of 2, since 'para' array is passed to 'rtwfwbtwificontrolrtwdev, para0, ¶1', which reads 5 bytes: void rtwfwbtwificontrolstruct...