Bounds Check Vulnerability in Linux Kernel WiFi Driver

CVE-2026-74409

What is CVE-2026-74409?

A vulnerability exists in the Linux kernel's WiFi driver, where the mac_id field in RX descriptors is only 8 bits wide, allowing values from 0 to 255. However, the associated link management array (assoc_link_on_macid[]) is limited to 128 entries. While the driver assigns mac_id values that are below 128, the mac_id descriptor originates from firmware and lacks proper validation before it's used as an array index. This oversight necessitated the introduction of a bounds check in the function rtw89_assoc_link_rcu_dereference() to prevent potential out-of-range values from corrupting memory or causing unintended behavior.

References