CVE-2026-74411
Estado: RecibidaAlta (8.8)—
In the Linux kernel, the following vulnerability has been resolved:
wifi: rtw89: Correct data type for scan index to avoid infinite loop
A kernel soft lockup was observed during Wi-Fi scanning on the 6GHz band. The CPU becomes stuck in rtw89_hw_scan_add_chan_ax for over 20 seconds, leading to a system panic.
RIP points to 0f b6 c3 (movzbl %bl, %eax), which zero-extends the low 8 bits of RBX into RAX. RBX (the counter i) has reached a huge value: 0x137466a1.
By objdump with source:
Detalles técnicos trazas, registros y código del informe original
watchdog: BUG: soft lockup - CPU#2 stuck for 26s! [kworker/u16:4:6124]
Workqueue: events_unbound cfg80211_wiphy_work [cfg80211]
RIP: 0010:rtw89_hw_scan_add_chan_ax+0xb3/0x6e0 [rtw89_core]
Code: a0 48 89 45 a8 44 89 6d 9c 44 89 75 98 eb 29 66 66 2e 0f 1f
84 00 00 00 00 00 66 66 2e 0f 1f 84 00 00 00 00 00 66 90 83 c3 01
<0f> b6 c3 41 3b 44 24 74 0f 83 0b 02 00 00 0f b6 c3 48 8d 14 80 49
RSP: 0018:ffffcb48cbaa39f8 EFLAGS: 00000202
RAX: 0000000000000005 RBX: 00000000137466a1 RCX: 0000000000000000
RDX: ffff89ffc9d851a8 RSI: 0000000000004f0d RDI: 0000000096af0130
RBP: ffffcb48cbaa3a60 R08: 0000000000000000 R09: ffff8a00b7502080
R10: ffff8a00b75ff600 R11: 0000000000000000 R12: ffff89ffc7553870
R13: ffff8a00b7ac8f19 R14: ffff8a00b75020d8 R15: ffff89ffc3d54d80
FS: 0000000000000000(0000) GS:ffff8a014f962000(0000)
knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007558d7f9f4c4 CR3: 0000000178040001 CR4: 00000000001706f0
Call Trace:
<TASK>
rtw89_hw_scan_prep_chan_list_ax+0x8a/0x400 [rtw89_core]
rtw89_hw_scan_start+0x546/0x8a0 [rtw89_core]
? rtw89_fw_h2c_default_cmac_tbl+0x13c/0x1f0 [rtw89_core]
rtw89_ops_hw_scan+0xae/0x120 [rtw89_core]
drv_hw_scan+0xbb/0x180 [mac80211]
__ieee80211_start_scan+0x2fc/0x750 [mac80211]
ieee80211_request_scan+0xe/0x20 [mac80211]
ieee80211_scan+0x123/0x190 [mac80211]
rdev_scan+0x40/0x110 [cfg80211]
cfg80211_scan_6ghz+0x5a1/0xa30 [cfg80211]
for (i = 0; i < req->n_6ghz_params; i++) {
5fbc0: 83 c3 01 add $0x1,%ebx --> i++
5fbc3: 0f b6 c3 movzbl %bl,%eax --> get counter
fbc6: 41 3b 44 24 74 cmp 0x74(%r12),%eax
* RBX: 00000000137466a1 -> %bl = a1 -> EAX = 000000a1 (161)CVSS
- Versión: 3.1
- Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Puntuación base: 8.8
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 0.40%
- Percentil entre todas las CVEs puntuadas: 32
- Fecha de la puntuación: 6/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
🎯 Técnicas ATT&CK
Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.
- Explotación
T1210Exploitation of Remote Serviceslateral movement25 % - Impacto principal
T1499.004Application or System Exploitationimpact75 % - Impacto secundario
T1068Exploitation for Privilege Escalationprivilege escalation35 %
Vector AV:A (red adyacente) sugiere T1210, pero el defecto es un desbordamiento de tipo sin interacción remota detectada, causando DoS por bloqueo del kernel (soft lockup 26s). T1068 posible si la ejecución de código ocurre en contexto de kernel.
Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.
🛡️ Mitigaciones ATT&CK que cubren estas técnicas
Tecnologías afectadas (1)
⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.
Referencias
- https://git.kernel.org/stable/c/05d46e30303275f21f13c951166d39c85df976d4
- https://git.kernel.org/stable/c/08fdcb529df6df3562dd2b0035f88dd5be8b3c68
- https://git.kernel.org/stable/c/140fa699cfd0e18ab2f1497acd951fb3548610f5
- https://git.kernel.org/stable/c/7a1ab5fdcae896e20ca6d68fa0fbd2816cb7471f
- https://git.kernel.org/stable/c/966fbed4b4463fbcb49c5becf3f86eae776861bd
JSON original (NVD)
Mostrar
{
"id": "CVE-2026-74411",
"cveTags": [],
"metrics": {
"cvssMetricV31": [
{
"type": "Secondary",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 8.8,
"attackVector": "ADJACENT_NETWORK",
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"integrityImpact": "HIGH",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "NONE",
"confidentialityImpact": "HIGH"
},
"impactScore": 5.9,
"exploitabilityScore": 2.8
}
]
},
"affected": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"affectedData": [
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "c6aa9a9c47252ac7b07ed6d10459027e2f2a2de0",
"lessThan": "966fbed4b4463fbcb49c5becf3f86eae776861bd",
"versionType": "git"
},
{
"status": "affected",
"version": "c6aa9a9c47252ac7b07ed6d10459027e2f2a2de0",
"lessThan": "05d46e30303275f21f13c951166d39c85df976d4",
"versionType": "git"
},
{
"status": "affected",
"version": "c6aa9a9c47252ac7b07ed6d10459027e2f2a2de0",
"lessThan": "7a1ab5fdcae896e20ca6d68fa0fbd2816cb7471f",
"versionType": "git"
},
{
"status": "affected",
"version": "c6aa9a9c47252ac7b07ed6d10459027e2f2a2de0",
"lessThan": "140fa699cfd0e18ab2f1497acd951fb3548610f5",
"versionType": "git"
},
{
"status": "affected",
"version": "c6aa9a9c47252ac7b07ed6d10459027e2f2a2de0",
"lessThan": "08fdcb529df6df3562dd2b0035f88dd5be8b3c68",
"versionType": "git"
}
],
"programFiles": [
"drivers/net/wireless/realtek/rtw89/fw.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "6.4"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "6.4",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver",
"lessThanOrEqual": "6.6.*"
},
{
"status": "unaffected",
"version": "6.12.97",
"versionType": "semver",
"lessThanOrEqual": "6.12.*"
},
{
"status": "unaffected",
"version": "6.18.40",
"versionType": "semver",
"lessThanOrEqual": "6.18.*"
},
{
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver",
"lessThanOrEqual": "7.1.*"
},
{
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"drivers/net/wireless/realtek/rtw89/fw.c"
],
"defaultStatus": "affected"
}
]
}
],
"published": "2026-08-15T06:22:43.197",
"references": [
{
"url": "https://git.kernel.org/stable/c/05d46e30303275f21f13c951166d39c85df976d4",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/08fdcb529df6df3562dd2b0035f88dd5be8b3c68",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/140fa699cfd0e18ab2f1497acd951fb3548610f5",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/7a1ab5fdcae896e20ca6d68fa0fbd2816cb7471f",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/966fbed4b4463fbcb49c5becf3f86eae776861bd",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
],
"vulnStatus": "Received",
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: rtw89: Correct data type for scan index to avoid infinite loop\n\nA kernel soft lockup was observed during Wi-Fi scanning on the 6GHz band.\nThe CPU becomes stuck in rtw89_hw_scan_add_chan_ax for over 20 seconds,\nleading to a system panic.\n\nRIP points to 0f b6 c3 (movzbl %bl, %eax), which zero-extends\nthe low 8 bits of RBX into RAX.\nRBX (the counter i) has reached a huge value: 0x137466a1.\n\n watchdog: BUG: soft lockup - CPU#2 stuck for 26s! [kworker/u16:4:6124]\n Workqueue: events_unbound cfg80211_wiphy_work [cfg80211]\n RIP: 0010:rtw89_hw_scan_add_chan_ax+0xb3/0x6e0 [rtw89_core]\n Code: a0 48 89 45 a8 44 89 6d 9c 44 89 75 98 eb 29 66 66 2e 0f 1f\n 84 00 00 00 00 00 66 66 2e 0f 1f 84 00 00 00 00 00 66 90 83 c3 01\n <0f> b6 c3 41 3b 44 24 74 0f 83 0b 02 00 00 0f b6 c3 48 8d 14 80 49\n RSP: 0018:ffffcb48cbaa39f8 EFLAGS: 00000202\n RAX: 0000000000000005 RBX: 00000000137466a1 RCX: 0000000000000000\n RDX: ffff89ffc9d851a8 RSI: 0000000000004f0d RDI: 0000000096af0130\n RBP: ffffcb48cbaa3a60 R08: 0000000000000000 R09: ffff8a00b7502080\n R10: ffff8a00b75ff600 R11: 0000000000000000 R12: ffff89ffc7553870\n R13: ffff8a00b7ac8f19 R14: ffff8a00b75020d8 R15: ffff89ffc3d54d80\n FS: 0000000000000000(0000) GS:ffff8a014f962000(0000)\n knlGS:0000000000000000\n CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n CR2: 00007558d7f9f4c4 CR3: 0000000178040001 CR4: 00000000001706f0\n Call Trace:\n <TASK>\n rtw89_hw_scan_prep_chan_list_ax+0x8a/0x400 [rtw89_core]\n rtw89_hw_scan_start+0x546/0x8a0 [rtw89_core]\n ? rtw89_fw_h2c_default_cmac_tbl+0x13c/0x1f0 [rtw89_core]\n rtw89_ops_hw_scan+0xae/0x120 [rtw89_core]\n drv_hw_scan+0xbb/0x180 [mac80211]\n __ieee80211_start_scan+0x2fc/0x750 [mac80211]\n ieee80211_request_scan+0xe/0x20 [mac80211]\n ieee80211_scan+0x123/0x190 [mac80211]\n rdev_scan+0x40/0x110 [cfg80211]\n cfg80211_scan_6ghz+0x5a1/0xa30 [cfg80211]\n\nBy objdump with source:\n\n\tfor (i = 0; i < req->n_6ghz_params; i++) {\n 5fbc0:\t83 c3 01 \tadd $0x1,%ebx --> i++\n 5fbc3:\t0f b6 c3 \tmovzbl %bl,%eax --> get counter\n fbc6:\t41 3b 44 24 74 \tcmp 0x74(%r12),%eax\n\n * RBX: 00000000137466a1 -> %bl = a1 -> EAX = 000000a1 (161)"
}
],
"lastModified": "2026-08-17T06:19:36.533",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}