CVE-2026-74410: wifi: rtw88: fix OOB read from firmware RX descriptor exceeding DMA buffer

From: Greg Kroah-Hartman <[email protected]>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

wifi: rtw88: fix OOB read from firmware RX descriptor exceeding DMA buffer

In rtw_pci_rx_napi(), new_len is computed as the sum of pkt_len (14-bit
descriptor field, max 16383) and pkt_offset (drv_info_sz + shift, both
firmware-controlled). The result can exceed RTK_PCI_RX_BUF_SIZE (11478),
causing an out-of-bounds read from the pre-allocated DMA buffer when
skb_put_data copies new_len bytes. The USB transport already validates
this (rtw_usb_rx_data_put checks against RTW_USB_MAX_RECVBUF_SZ); the
PCIe path does not.

Add a check that new_len does not exceed the DMA buffer size.

The Linux kernel CVE team has assigned CVE-2026-74410 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 5.2 with commit e3037485c68ec1a299ff41160d8fedbd4abc29b9 and fixed in 5.10.261 with commit 913bd7d3d3d842b5c1d2b908a0201efa8fc79793
	Issue introduced in 5.2 with commit e3037485c68ec1a299ff41160d8fedbd4abc29b9 and fixed in 5.15.212 with commit 45abc14ab3f15da7d689f1a8809c1a01240a94d9
	Issue introduced in 5.2 with commit e3037485c68ec1a299ff41160d8fedbd4abc29b9 and fixed in 6.1.178 with commit 08193e733e5d4790e6c937af86d78793b02709be
	Issue introduced in 5.2 with commit e3037485c68ec1a299ff41160d8fedbd4abc29b9 and fixed in 6.6.145 with commit 6a3c384393d3f0b41669ed5a2e88744aad9d87c8
	Issue introduced in 5.2 with commit e3037485c68ec1a299ff41160d8fedbd4abc29b9 and fixed in 6.12.97 with commit 26c183a86ea4dd1f2ff90c6f783649e7f5722a10
	Issue introduced in 5.2 with commit e3037485c68ec1a299ff41160d8fedbd4abc29b9 and fixed in 6.18.40 with commit 01155ded5d4dad61840a9a3c33ab56778ef1f100
	Issue introduced in 5.2 with commit e3037485c68ec1a299ff41160d8fedbd4abc29b9 and fixed in 7.1.5 with commit 1554fa522f16ec7c5c342ad33fe734eeb6eb2452
	Issue introduced in 5.2 with commit e3037485c68ec1a299ff41160d8fedbd4abc29b9 and fixed in 7.2-rc1 with commit 6e76e9ed273dfb4b3333a5ebbb94958cc5752ab6

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-74410
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/net/wireless/realtek/rtw88/pci.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/913bd7d3d3d842b5c1d2b908a0201efa8fc79793
	https://git.kernel.org/stable/c/45abc14ab3f15da7d689f1a8809c1a01240a94d9
	https://git.kernel.org/stable/c/08193e733e5d4790e6c937af86d78793b02709be
	https://git.kernel.org/stable/c/6a3c384393d3f0b41669ed5a2e88744aad9d87c8
	https://git.kernel.org/stable/c/26c183a86ea4dd1f2ff90c6f783649e7f5722a10
	https://git.kernel.org/stable/c/01155ded5d4dad61840a9a3c33ab56778ef1f100
	https://git.kernel.org/stable/c/1554fa522f16ec7c5c342ad33fe734eeb6eb2452
	https://git.kernel.org/stable/c/6e76e9ed273dfb4b3333a5ebbb94958cc5752ab6