CVE-2026-74411 (GCVE-0-2026-74411)

Vulnerability from cvelistv5 – Published: 2026-08-15 05:59 – Updated: 2026-08-17 05:46
VLAI
Title
wifi: rtw89: Correct data type for scan index to avoid infinite loop
Summary
In the Linux kernel, the following vulnerability has been resolved: wifi: rtw89: Correct data type for scan index to avoid infinite loop A kernel soft lockup was observed during Wi-Fi scanning on the 6GHz band. The CPU becomes stuck in rtw89_hw_scan_add_chan_ax for over 20 seconds, leading to a system panic. RIP points to 0f b6 c3 (movzbl %bl, %eax), which zero-extends the low 8 bits of RBX into RAX. RBX (the counter i) has reached a huge value: 0x137466a1. watchdog: BUG: soft lockup - CPU#2 stuck for 26s! [kworker/u16:4:6124] Workqueue: events_unbound cfg80211_wiphy_work [cfg80211] RIP: 0010:rtw89_hw_scan_add_chan_ax+0xb3/0x6e0 [rtw89_core] Code: a0 48 89 45 a8 44 89 6d 9c 44 89 75 98 eb 29 66 66 2e 0f 1f 84 00 00 00 00 00 66 66 2e 0f 1f 84 00 00 00 00 00 66 90 83 c3 01 <0f> b6 c3 41 3b 44 24 74 0f 83 0b 02 00 00 0f b6 c3 48 8d 14 80 49 RSP: 0018:ffffcb48cbaa39f8 EFLAGS: 00000202 RAX: 0000000000000005 RBX: 00000000137466a1 RCX: 0000000000000000 RDX: ffff89ffc9d851a8 RSI: 0000000000004f0d RDI: 0000000096af0130 RBP: ffffcb48cbaa3a60 R08: 0000000000000000 R09: ffff8a00b7502080 R10: ffff8a00b75ff600 R11: 0000000000000000 R12: ffff89ffc7553870 R13: ffff8a00b7ac8f19 R14: ffff8a00b75020d8 R15: ffff89ffc3d54d80 FS: 0000000000000000(0000) GS:ffff8a014f962000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007558d7f9f4c4 CR3: 0000000178040001 CR4: 00000000001706f0 Call Trace: <TASK> rtw89_hw_scan_prep_chan_list_ax+0x8a/0x400 [rtw89_core] rtw89_hw_scan_start+0x546/0x8a0 [rtw89_core] ? rtw89_fw_h2c_default_cmac_tbl+0x13c/0x1f0 [rtw89_core] rtw89_ops_hw_scan+0xae/0x120 [rtw89_core] drv_hw_scan+0xbb/0x180 [mac80211] __ieee80211_start_scan+0x2fc/0x750 [mac80211] ieee80211_request_scan+0xe/0x20 [mac80211] ieee80211_scan+0x123/0x190 [mac80211] rdev_scan+0x40/0x110 [cfg80211] cfg80211_scan_6ghz+0x5a1/0xa30 [cfg80211] By objdump with source: for (i = 0; i < req->n_6ghz_params; i++) { 5fbc0: 83 c3 01 add $0x1,%ebx --> i++ 5fbc3: 0f b6 c3 movzbl %bl,%eax --> get counter fbc6: 41 3b 44 24 74 cmp 0x74(%r12),%eax * RBX: 00000000137466a1 -> %bl = a1 -> EAX = 000000a1 (161)
Severity
8.8 (High)
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: c6aa9a9c47252ac7b07ed6d10459027e2f2a2de0 , < 966fbed4b4463fbcb49c5becf3f86eae776861bd (git)
Affected: c6aa9a9c47252ac7b07ed6d10459027e2f2a2de0 , < 05d46e30303275f21f13c951166d39c85df976d4 (git)
Affected: c6aa9a9c47252ac7b07ed6d10459027e2f2a2de0 , < 7a1ab5fdcae896e20ca6d68fa0fbd2816cb7471f (git)
Affected: c6aa9a9c47252ac7b07ed6d10459027e2f2a2de0 , < 140fa699cfd0e18ab2f1497acd951fb3548610f5 (git)
Affected: c6aa9a9c47252ac7b07ed6d10459027e2f2a2de0 , < 08fdcb529df6df3562dd2b0035f88dd5be8b3c68 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.4
Unaffected: 0 , < 6.4 (semver)
Unaffected: 6.6.145 , ≤ 6.6.* (semver)
Unaffected: 6.12.97 , ≤ 6.12.* (semver)
Unaffected: 6.18.40 , ≤ 6.18.* (semver)
Unaffected: 7.1.5 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wireless/realtek/rtw89/fw.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "966fbed4b4463fbcb49c5becf3f86eae776861bd",
              "status": "affected",
              "version": "c6aa9a9c47252ac7b07ed6d10459027e2f2a2de0",
              "versionType": "git"
            },
            {
              "lessThan": "05d46e30303275f21f13c951166d39c85df976d4",
              "status": "affected",
              "version": "c6aa9a9c47252ac7b07ed6d10459027e2f2a2de0",
              "versionType": "git"
            },
            {
              "lessThan": "7a1ab5fdcae896e20ca6d68fa0fbd2816cb7471f",
              "status": "affected",
              "version": "c6aa9a9c47252ac7b07ed6d10459027e2f2a2de0",
              "versionType": "git"
            },
            {
              "lessThan": "140fa699cfd0e18ab2f1497acd951fb3548610f5",
              "status": "affected",
              "version": "c6aa9a9c47252ac7b07ed6d10459027e2f2a2de0",
              "versionType": "git"
            },
            {
              "lessThan": "08fdcb529df6df3562dd2b0035f88dd5be8b3c68",
              "status": "affected",
              "version": "c6aa9a9c47252ac7b07ed6d10459027e2f2a2de0",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wireless/realtek/rtw89/fw.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.4"
            },
            {
              "lessThan": "6.4",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.97",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.40",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.97",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.40",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: rtw89: Correct data type for scan index to avoid infinite loop\n\nA kernel soft lockup was observed during Wi-Fi scanning on the 6GHz band.\nThe CPU becomes stuck in rtw89_hw_scan_add_chan_ax for over 20 seconds,\nleading to a system panic.\n\nRIP points to 0f b6 c3 (movzbl %bl, %eax), which zero-extends\nthe low 8 bits of RBX into RAX.\nRBX (the counter i) has reached a huge value: 0x137466a1.\n\n  watchdog: BUG: soft lockup - CPU#2 stuck for 26s! [kworker/u16:4:6124]\n  Workqueue: events_unbound cfg80211_wiphy_work [cfg80211]\n  RIP: 0010:rtw89_hw_scan_add_chan_ax+0xb3/0x6e0 [rtw89_core]\n  Code: a0 48 89 45 a8 44 89 6d 9c 44 89 75 98 eb 29 66 66 2e 0f 1f\n  84 00 00 00 00 00 66 66 2e 0f 1f 84 00 00 00 00 00 66 90 83 c3 01\n  \u003c0f\u003e b6 c3 41 3b 44 24 74 0f 83 0b 02 00 00 0f b6 c3 48 8d 14 80 49\n  RSP: 0018:ffffcb48cbaa39f8 EFLAGS: 00000202\n  RAX: 0000000000000005 RBX: 00000000137466a1 RCX: 0000000000000000\n  RDX: ffff89ffc9d851a8 RSI: 0000000000004f0d RDI: 0000000096af0130\n  RBP: ffffcb48cbaa3a60 R08: 0000000000000000 R09: ffff8a00b7502080\n  R10: ffff8a00b75ff600 R11: 0000000000000000 R12: ffff89ffc7553870\n  R13: ffff8a00b7ac8f19 R14: ffff8a00b75020d8 R15: ffff89ffc3d54d80\n  FS:  0000000000000000(0000) GS:ffff8a014f962000(0000)\n  knlGS:0000000000000000\n  CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n  CR2: 00007558d7f9f4c4 CR3: 0000000178040001 CR4: 00000000001706f0\n  Call Trace:\n   \u003cTASK\u003e\n   rtw89_hw_scan_prep_chan_list_ax+0x8a/0x400 [rtw89_core]\n   rtw89_hw_scan_start+0x546/0x8a0 [rtw89_core]\n   ? rtw89_fw_h2c_default_cmac_tbl+0x13c/0x1f0 [rtw89_core]\n   rtw89_ops_hw_scan+0xae/0x120 [rtw89_core]\n   drv_hw_scan+0xbb/0x180 [mac80211]\n   __ieee80211_start_scan+0x2fc/0x750 [mac80211]\n   ieee80211_request_scan+0xe/0x20 [mac80211]\n   ieee80211_scan+0x123/0x190 [mac80211]\n   rdev_scan+0x40/0x110 [cfg80211]\n   cfg80211_scan_6ghz+0x5a1/0xa30 [cfg80211]\n\nBy objdump with source:\n\n\tfor (i = 0; i \u003c req-\u003en_6ghz_params; i++) {\n   5fbc0:\t83 c3 01             \tadd    $0x1,%ebx --\u003e i++\n   5fbc3:\t0f b6 c3             \tmovzbl %bl,%eax  --\u003e get counter\n   fbc6:\t41 3b 44 24 74       \tcmp    0x74(%r12),%eax\n\n   * RBX: 00000000137466a1 -\u003e %bl = a1 -\u003e EAX = 000000a1 (161)"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:A - The flaw is in the rtw89 WiFi driver scan path; an attacker on the same wireless segment can inject forged RNR/beacon frames to inflate n_6ghz_params above 255, triggering the vulnerable loop during cfg80211 6GHz split-scan processing.\nAC:L - An attacker can reliably flood the BSS cache with 256+ colocated 6GHz AP entries via crafted beacons and wait for routine background or split-scan 6GHz scans on rtw89 hardware; no race or rare configuration outside attacker control is required.\nPR:N - Exploitation requires only transmitting WiFi frames on the victim\u0027s RF segment to poison scan inputs; the attacker needs no local account, capability, or namespace privilege on the victim host.\nUI:N - The bug fires during automatic kernel/WiFi-stack scanning, including the split-scan 6GHz phase after legacy-band scans; victims need not perform any explicit action beyond normal powered-on operation.\nS:U - Impact is kernel soft lockup/panic and potential heap out-of-bounds access within kernel space; it does not cross VM, container, or IOMMU boundaries to another security authority.\nC:H - The u8 loop counter truncates at 256 while the index register grows unboundedly, causing out-of-bounds reads of scan_6ghz_params and attacker-influenced channel_idx values used to dereference req-\u003echannels[].\nI:H - The same out-of-bounds indexing drives writes (probe-request skb setup, firmware offload, heap list updates) using corrupted param data, enabling memory corruption beyond simple denial of service.\nA:H - Confirmed kernel soft lockup exceeding 26 seconds in rtw89_hw_scan_add_chan_ax with watchdog-forced panic, rendering the system unavailable until reboot."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T05:46:54.903Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/966fbed4b4463fbcb49c5becf3f86eae776861bd"
        },
        {
          "url": "https://git.kernel.org/stable/c/05d46e30303275f21f13c951166d39c85df976d4"
        },
        {
          "url": "https://git.kernel.org/stable/c/7a1ab5fdcae896e20ca6d68fa0fbd2816cb7471f"
        },
        {
          "url": "https://git.kernel.org/stable/c/140fa699cfd0e18ab2f1497acd951fb3548610f5"
        },
        {
          "url": "https://git.kernel.org/stable/c/08fdcb529df6df3562dd2b0035f88dd5be8b3c68"
        }
      ],
      "title": "wifi: rtw89: Correct data type for scan index to avoid infinite loop",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74411",
    "datePublished": "2026-08-15T05:59:18.696Z",
    "dateReserved": "2026-08-15T05:44:03.892Z",
    "dateUpdated": "2026-08-17T05:46:54.903Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-74411",
      "date": "2026-09-21",
      "epss": "0.00254",
      "percentile": "0.17155"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/net/wireless/realtek/rtw89/fw.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "966fbed4b4463fbcb49c5becf3f86eae776861bd",
                    "status": "affected",
                    "version": "c6aa9a9c47252ac7b07ed6d10459027e2f2a2de0",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "05d46e30303275f21f13c951166d39c85df976d4",
                    "status": "affected",
                    "version": "c6aa9a9c47252ac7b07ed6d10459027e2f2a2de0",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "7a1ab5fdcae896e20ca6d68fa0fbd2816cb7471f",
                    "status": "affected",
                    "version": "c6aa9a9c47252ac7b07ed6d10459027e2f2a2de0",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "140fa699cfd0e18ab2f1497acd951fb3548610f5",
                    "status": "affected",
                    "version": "c6aa9a9c47252ac7b07ed6d10459027e2f2a2de0",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "08fdcb529df6df3562dd2b0035f88dd5be8b3c68",
                    "status": "affected",
                    "version": "c6aa9a9c47252ac7b07ed6d10459027e2f2a2de0",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/net/wireless/realtek/rtw89/fw.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.4"
                  },
                  {
                    "lessThan": "6.4",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.145",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.97",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.40",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.1.*",
                    "status": "unaffected",
                    "version": "7.1.5",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.2",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: rtw89: Correct data type for scan index to avoid infinite loop\n\nA kernel soft lockup was observed during Wi-Fi scanning on the 6GHz band.\nThe CPU becomes stuck in rtw89_hw_scan_add_chan_ax for over 20 seconds,\nleading to a system panic.\n\nRIP points to 0f b6 c3 (movzbl %bl, %eax), which zero-extends\nthe low 8 bits of RBX into RAX.\nRBX (the counter i) has reached a huge value: 0x137466a1.\n\n  watchdog: BUG: soft lockup - CPU#2 stuck for 26s! [kworker/u16:4:6124]\n  Workqueue: events_unbound cfg80211_wiphy_work [cfg80211]\n  RIP: 0010:rtw89_hw_scan_add_chan_ax+0xb3/0x6e0 [rtw89_core]\n  Code: a0 48 89 45 a8 44 89 6d 9c 44 89 75 98 eb 29 66 66 2e 0f 1f\n  84 00 00 00 00 00 66 66 2e 0f 1f 84 00 00 00 00 00 66 90 83 c3 01\n  \u003c0f\u003e b6 c3 41 3b 44 24 74 0f 83 0b 02 00 00 0f b6 c3 48 8d 14 80 49\n  RSP: 0018:ffffcb48cbaa39f8 EFLAGS: 00000202\n  RAX: 0000000000000005 RBX: 00000000137466a1 RCX: 0000000000000000\n  RDX: ffff89ffc9d851a8 RSI: 0000000000004f0d RDI: 0000000096af0130\n  RBP: ffffcb48cbaa3a60 R08: 0000000000000000 R09: ffff8a00b7502080\n  R10: ffff8a00b75ff600 R11: 0000000000000000 R12: ffff89ffc7553870\n  R13: ffff8a00b7ac8f19 R14: ffff8a00b75020d8 R15: ffff89ffc3d54d80\n  FS:  0000000000000000(0000) GS:ffff8a014f962000(0000)\n  knlGS:0000000000000000\n  CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n  CR2: 00007558d7f9f4c4 CR3: 0000000178040001 CR4: 00000000001706f0\n  Call Trace:\n   \u003cTASK\u003e\n   rtw89_hw_scan_prep_chan_list_ax+0x8a/0x400 [rtw89_core]\n   rtw89_hw_scan_start+0x546/0x8a0 [rtw89_core]\n   ? rtw89_fw_h2c_default_cmac_tbl+0x13c/0x1f0 [rtw89_core]\n   rtw89_ops_hw_scan+0xae/0x120 [rtw89_core]\n   drv_hw_scan+0xbb/0x180 [mac80211]\n   __ieee80211_start_scan+0x2fc/0x750 [mac80211]\n   ieee80211_request_scan+0xe/0x20 [mac80211]\n   ieee80211_scan+0x123/0x190 [mac80211]\n   rdev_scan+0x40/0x110 [cfg80211]\n   cfg80211_scan_6ghz+0x5a1/0xa30 [cfg80211]\n\nBy objdump with source:\n\n\tfor (i = 0; i \u003c req-\u003en_6ghz_params; i++) {\n   5fbc0:\t83 c3 01             \tadd    $0x1,%ebx --\u003e i++\n   5fbc3:\t0f b6 c3             \tmovzbl %bl,%eax  --\u003e get counter\n   fbc6:\t41 3b 44 24 74       \tcmp    0x74(%r12),%eax\n\n   * RBX: 00000000137466a1 -\u003e %bl = a1 -\u003e EAX = 000000a1 (161)"
          }
        ],
        "id": "CVE-2026-74411",
        "lastModified": "2026-08-17T06:19:36.533",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "ADJACENT_NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 8.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 2.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-08-15T06:22:43.197",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/05d46e30303275f21f13c951166d39c85df976d4"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/08fdcb529df6df3562dd2b0035f88dd5be8b3c68"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/140fa699cfd0e18ab2f1497acd951fb3548610f5"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/7a1ab5fdcae896e20ca6d68fa0fbd2816cb7471f"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/966fbed4b4463fbcb49c5becf3f86eae776861bd"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-20T22:19:14+00:00",
      "cve": "CVE-2026-74411",
      "id": "CVE-2026-74411",
      "initial_release_date": "2026-08-15T00:00:00+00:00",
      "product_status:known_affected": "232",
      "product_status:known_not_affected": "42",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: wifi: rtw89: Correct data type for scan index to avoid infinite loop",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74411.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.