CVE-2026-74409 wifi: rtw89: add bounds check on firmware mac_id in link lookup
A missing bounds check in the rtw89 WiFi driver allows out-of-bounds array access via firmware-provided mac_id, potentially causing crashes or data leaks.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-74409?
CVE-2026-74409 is a high-severity memory corruption vulnerability in Linux, published on 15 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
wifi: rtw89: add bounds check on firmware mac_id in link lookup
The mac_id field in RX descriptors is 8 bits wide (0-255), but assoc_link_on_macid[] has only RTW89_MAX_MAC_ID_NUM (128) entries. While the driver currently assigns mac_id values below 128, the descriptor value comes from firmware and is not validated before use as an array index. Add a defensive bounds check in rtw89_assoc_link_rcu_dereference() to guard against out-of-range firmware values.
Which versions are affected by CVE-2026-74409?
How do I fix CVE-2026-74409?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-74409 being exploited?
There is no known exploitation of CVE-2026-74409 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2026-74409, DEBIAN-CVE-2026-74409, GHSA-58gw-vjvj-7rmp, UBUNTU-CVE-2026-74409.