LiveActive security incident?Get immediate response
CVE Record

CVE-2026-43213: wifi: rtw89: pci: validate sequence number of TX release report

In the Linux kernel, the following vulnerability has been resolved: wifi: rtw89: pci: validate sequence number of TX release report Hardware rarely reports abnormal sequence number in TX release report, which will access out-of-bounds of wd_ring->pages array, causing NULL pointer dereference. BUG: kernel NULL pointer dereference, address: 0000000000000000 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 0 P4D 0 Oops: 0000 [#1] PREEMPT SMP NOPTI CPU: 1 PID: 1085 Comm: irq/129-rtw89_p Tainted: G S U 6.1.145-17510-g2f3369c91536 #1 (HASH:69e8 1) Call Trace: <IRQ> rtw89_pci_release_tx+0x18f/0x300 [rtw89_pci (HASH:4c83 2)] rtw89_pci_napi_poll+0xc2/0x190 [rtw89_pci (HASH:4c83 2)] net_rx_action+0xfc/0x460 net/core/dev.c:6578 net/core/dev.c:6645 net/core/dev.c:6759 handle_softirqs+0xbe/0x290 kernel/softirq.c:601 ? rtw89_pci_interrupt_threadfn+0xc5/0x350 [rtw89_pci (HASH:4c83 2)] __local_bh_enable_ip+0xeb/0x120 kernel/softirq.c:499 kernel/softirq.c:423 </IRQ> <TASK> rtw89_pci_interrupt_threadfn+0xf8/0x350 [rtw89_pci (HASH:4c83 2)] ? irq_thread+0xa7/0x340 kernel/irq/manage.c:0 irq_thread+0x177/0x340 kernel/irq/manage.c:1205 kernel/irq/manage.c:1314 ? thaw_kernel_threads+0xb0/0xb0 kernel/irq/manage.c:1202 ? irq_forced_thread_fn+0x80/0x80 kernel/irq/manage.c:1220 kthread+0xea/0x110 kernel/kthread.c:376 ? synchronize_irq+0x1a0/0x1a0 kernel/irq/manage.c:1287 ? kthread_associate_blkcg+0x80/0x80 kernel/kthread.c:331 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295 </TASK> To prevent crash, validate rpp_info.seq before using.

HighCVSS 7.5Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

A rare abnormal report from hardware handled by the Linux rtw89 PCI Wi-Fi driver can make the kernel access outside an array and crash. This can disrupt affected endpoints or appliances. The supplied CVSS rating is 7.5, but the available evidence does not demonstrate reliable attacker control, data theft, or code execution.

Executive priority

Treat this as a high-priority availability issue for fleets using the affected driver, especially operationally critical wireless systems. Patch through supported kernel channels after confirming applicability. Broader emergency action is not supported because active exploitation and reliable attacker triggering are not evidenced.

Technical view

The rtw89_pci transmit-release path uses rpp_info.seq to index wd_ring->pages without first validating the sequence number. An abnormal value can cause an out-of-bounds access followed by a kernel NULL-pointer dereference in interrupt processing. The referenced stable changes validate the sequence before use.

Likely exposure

Exposure is limited to Linux systems using affected kernels with the rtw89 PCI driver and compatible Wi-Fi hardware. The supplied version data is ambiguous, so kernel version numbers alone are insufficient; distribution backports and driver presence must be checked.

Exploitation context

The CVSS vector describes adjacent access, high complexity, no privileges, and no user interaction. KEV is false, and the supplied sources provide no evidence of active exploitation or a public exploit. They describe a rare hardware-generated condition; whether an attacker can deliberately trigger it is not established.

Researcher notes

The demonstrated consequence is an out-of-bounds array access resolving to a NULL-pointer dereference during TX release processing. Although the supplied CVSS claims confidentiality, integrity, and availability impact, the narrative evidence specifically demonstrates a crash. Trigger controllability, affected hardware scope, and exploitation reliability remain unclear.

Mitigation direction

  • Install an OS-vendor kernel update containing the applicable sequence-number validation fix.
  • Confirm distribution backport status against the three referenced Linux stable commits.
  • Prioritize patching exposed endpoints where a kernel crash would materially disrupt operations.
  • Follow vendor guidance if no confirmed fixed package is currently available.

Validation and detection

  • Identify systems loading the rtw89_pci driver and using its associated Wi-Fi hardware.
  • Record kernel and distribution package versions, including vendor backport information.
  • Verify the installed kernel contains the applicable referenced fix.
  • Review kernel logs for rtw89_pci NULL dereferences or matching release-path crash traces.
  • Retest Wi-Fi transmit activity after updating and confirm no regression or kernel fault.
Prepared
Confidence
medium
Sources
5

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2026-43213 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
7.5 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
3Timeline events
0ADP providers
4Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
7.5CVSS 3.1HighCVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H1.65.9Linux

Vulnerability scoring details

Base CVSS 3.1 score

7.5High
CVSS 3.1 vector shape for CVE-2026-43213Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxe3ec7017f6a20d12ddd9fe23d345ebb7b8c104dd, e3ec7017f6a20d12ddd9fe23d345ebb7b8c104dd, e3ec7017f6a20d12ddd9fe23d345ebb7b8c104ddunaffected
LinuxLinux5.16, 0, 6.18.16, 6.19.6, 7.0affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.