Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-74411— wifi: rtw89: Correct data type for scan index to avoid infinite loop

CVSS 8.8 · High EPSS 0.26% · P17

Affected Version Matrix 12

VendorProductVersion RangeStatus
LinuxLinuxc6aa9a9c47252ac7b07ed6d10459027e2f2a2de0< 966fbed4b4463fbcb49c5becf3f86eae776861bdaffected
c6aa9a9c47252ac7b07ed6d10459027e2f2a2de0< 05d46e30303275f21f13c951166d39c85df976d4affected
c6aa9a9c47252ac7b07ed6d10459027e2f2a2de0< 7a1ab5fdcae896e20ca6d68fa0fbd2816cb7471faffected
c6aa9a9c47252ac7b07ed6d10459027e2f2a2de0< 140fa699cfd0e18ab2f1497acd951fb3548610f5affected
c6aa9a9c47252ac7b07ed6d10459027e2f2a2de0< 08fdcb529df6df3562dd2b0035f88dd5be8b3c68affected
6.4affected
< 6.4unaffected
6.6.145≤ 6.6.*unaffected
… +4 more rows
Get alerts for future matching vulnerabilitiesLog in to subscribe

I. Basic Information for CVE-2026-74411

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
wifi: rtw89: Correct data type for scan index to avoid infinite loop
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: wifi: rtw89: Correct data type for scan index to avoid infinite loop A kernel soft lockup was observed during Wi-Fi scanning on the 6GHz band. The CPU becomes stuck in rtw89_hw_scan_add_chan_ax for over 20 seconds, leading to a system panic. RIP points to 0f b6 c3 (movzbl %bl, %eax), which zero-extends the low 8 bits of RBX into RAX. RBX (the counter i) has reached a huge value: 0x137466a1. watchdog: BUG: soft lockup - CPU#2 stuck for 26s! [kworker/u16:4:6124] Workqueue: events_unbound cfg80211_wiphy_work [cfg80211] RIP: 0010:rtw89_hw_scan_add_chan_ax+0xb3/0x6e0 [rtw89_core] Code: a0 48 89 45 a8 44 89 6d 9c 44 89 75 98 eb 29 66 66 2e 0f 1f 84 00 00 00 00 00 66 66 2e 0f 1f 84 00 00 00 00 00 66 90 83 c3 01 <0f> b6 c3 41 3b 44 24 74 0f 83 0b 02 00 00 0f b6 c3 48 8d 14 80 49 RSP: 0018:ffffcb48cbaa39f8 EFLAGS: 00000202 RAX: 0000000000000005 RBX: 00000000137466a1 RCX: 0000000000000000 RDX: ffff89ffc9d851a8 RSI: 0000000000004f0d RDI: 0000000096af0130 RBP: ffffcb48cbaa3a60 R08: 0000000000000000 R09: ffff8a00b7502080 R10: ffff8a00b75ff600 R11: 0000000000000000 R12: ffff89ffc7553870 R13: ffff8a00b7ac8f19 R14: ffff8a00b75020d8 R15: ffff89ffc3d54d80 FS: 0000000000000000(0000) GS:ffff8a014f962000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007558d7f9f4c4 CR3: 0000000178040001 CR4: 00000000001706f0 Call Trace: <TASK> rtw89_hw_scan_prep_chan_list_ax+0x8a/0x400 [rtw89_core] rtw89_hw_scan_start+0x546/0x8a0 [rtw89_core] ? rtw89_fw_h2c_default_cmac_tbl+0x13c/0x1f0 [rtw89_core] rtw89_ops_hw_scan+0xae/0x120 [rtw89_core] drv_hw_scan+0xbb/0x180 [mac80211] __ieee80211_start_scan+0x2fc/0x750 [mac80211] ieee80211_request_scan+0xe/0x20 [mac80211] ieee80211_scan+0x123/0x190 [mac80211] rdev_scan+0x40/0x110 [cfg80211] cfg80211_scan_6ghz+0x5a1/0xa30 [cfg80211] By objdump with source: for (i = 0; i < req->n_6ghz_params; i++) { 5fbc0: 83 c3 01 add $0x1,%ebx --> i++ 5fbc3: 0f b6 c3 movzbl %bl,%eax --> get counter fbc6: 41 3b 44 24 74 cmp 0x74(%r12),%eax * RBX: 00000000137466a1 -> %bl = a1 -> EAX = 000000a1 (161)
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5

Affected Products

VendorProductAffected VersionsCPESubscribe
LinuxLinux c6aa9a9c47252ac7b07ed6d10459027e2f2a2de0 ~ 966fbed4b4463fbcb49c5becf3f86eae776861bd -
LinuxLinux 6.4 -

II. Public POCs for CVE-2026-74411

#POC DescriptionSource LinkShenlong Link
AI-Generated POCPremium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-74411

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-74411 (4)

Same Patch Batch · Linux · 2026-08-15 · 846 CVEs total

CVE-2026-7428010.0 CRITICALcrypto: marvell/octeontx - fix DMA cleanup using wrong loop index
CVE-2026-7427910.0 CRITICALcrypto: cavium/cpt - fix DMA cleanup using wrong loop index
CVE-2026-7240710.0 CRITICALgeneve: validate inner network offset in geneve_gro_complete()
CVE-2026-7240810.0 CRITICALgeneve: gate GRO hint in geneve_gro_complete() on gs->gro_hint
CVE-2026-7447510.0 CRITICALvxlan: use neigh_ha_snapshot() in route_shortcircuit()
CVE-2026-7430910.0 CRITICALvdpa/octeon_ep: fix IRQ-to-ring mapping in interrupt handler
CVE-2026-7242110.0 CRITICALipv4: fib: Don't ignore error route in local/main tables.
CVE-2026-724939.9 CRITICALnet: serialize netif_running() check in enqueue_to_backlog()
CVE-2026-724669.8 CRITICALxprtrdma: Fix bcall rep leak and unbounded peek
CVE-2026-722489.8 CRITICALnetfilter: flowtable: support IPIP tunnel with direct xmit
CVE-2026-723819.8 CRITICALksmbd: fix use-after-free of fp->owner.name in durable handle owner check
CVE-2026-724779.8 CRITICALfs/ntfs3: call _ntfs_bad_inode() when failing to rename
CVE-2026-744069.8 CRITICALvxlan: Fix potential null-ptr-deref in vxlan_gro_prepare_receive().
CVE-2026-724739.8 CRITICALxprtrdma: Decouple req recycling from RPC completion
CVE-2026-721309.8 CRITICALnvmet-auth: reject short AUTH_RECEIVE buffers
CVE-2026-724519.8 CRITICALxfrm: Fix xfrm state cache insertion race
CVE-2026-743769.8 CRITICALmd/raid10: reset read_slot when reusing r10bio for discard
CVE-2026-722269.8 CRITICALbatman-adv: tt: prevent TVLV OOB check overflow
CVE-2026-744019.8 CRITICALdlm: fix add msg handle in send_queue ordered
CVE-2026-721299.8 CRITICALnvmet-rdma: handle inline data with a nonzero offset

Showing top 20 of 846 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2026-74411

No comments yet

Leave a comment