{"id":7373,"date":"2026-09-04T18:49:31","date_gmt":"2026-09-04T10:49:31","guid":{"rendered":"https:\/\/www.54iter.cn\/?vuln=cve-2026-74411"},"modified":"2026-09-04T18:49:31","modified_gmt":"2026-09-04T10:49:31","slug":"cve-2026-74411","status":"publish","type":"vuln","link":"https:\/\/www.54iter.cn\/?vuln=cve-2026-74411","title":{"rendered":"CVE-2026-74411 [HIGH] &#8211; In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: rtw89: Correct"},"content":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>wifi: rtw89: Correct data type for scan index to avoid infinite loop<\/p>\n<p>A kernel soft lockup was observed during Wi-Fi scanning on the 6GHz band.<br \/>\nThe CPU becomes stuck in rtw89_hw_scan_add_chan_ax for over 20 seconds,<br \/>\nleading to a system panic.<\/p>\n<p>RIP points to 0f b6 c3 (movzbl %bl, %eax), which zero-extends<br \/>\nthe low 8 bits of RBX into RAX.<br \/>\nRBX (the counter i) has reached a huge value: 0x137466a1.<\/p>\n<p>  watchdog: BUG: soft lockup &#8211; CPU#2 stuck for 26s! [kworker\/u16:4:6124]<br \/>\n  Workqueue: events_unbound cfg80211_wiphy_work [cfg80211]<br \/>\n  RIP: 0010:rtw89_hw_scan_add_chan_ax+0xb3\/0x6e0 [rtw89_core]<br \/>\n  Code: a0 48 89 45 a8 44 89 6d 9c 44 89 75 98 eb 29 66 66 2e 0f 1f<br \/>\n  84 00 00 00 00 00 66 66 2e 0f 1f 84 00 00 00 00 00 66 90 83 c3 01<br \/>\n   b6 c3 41 3b 44 24 74 0f 83 0b 02 00 00 0f b6 c3 48 8d 14 80 49<br \/>\n  RSP: 0018:ffffcb48cbaa39f8 EFLAGS: 00000202<br \/>\n  RAX: 0000000000000005 RBX: 00000000137466a1 RCX: 0000000000000000<br \/>\n  RDX: ffff89ffc9d851a8 RSI: 0000000000004f0d RDI: 0000000096af0130<br \/>\n  RBP: ffffcb48cbaa3a60 R08: 0000000000000000 R09: ffff8a00b7502080<br \/>\n  R10: ffff8a00b75ff600 R11: 0000000000000000 R12: ffff89ffc7553870<br \/>\n  R13: ffff8a00b7ac8f19 R14: ffff8a00b75020d8 R15: ffff89ffc3d54d80<br \/>\n  FS:  0000000000000000(0000) GS:ffff8a014f962000(0000)<br \/>\n  knlGS:0000000000000000<br \/>\n  CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033<br \/>\n  CR2: 00007558d7f9f4c4 CR3: 0000000178040001 CR4: 00000000001706f0<br \/>\n  Call Trace:<\/p>\n<p>   rtw89_hw_scan_prep_chan_list_ax+0x8a\/0x400 [rtw89_core]<br \/>\n   rtw89_hw_scan_start+0x546\/0x8a0 [rtw89_core]<br \/>\n   ? rtw89_fw_h2c_default_cmac_tbl+0x13c\/0x1f0 [rtw89_core]<br \/>\n   rtw89_ops_hw_scan+0xae\/0x120 [rtw89_core]<br \/>\n   drv_hw_scan+0xbb\/0x180 [mac80211]<br \/>\n   __ieee80211_start_scan+0x2fc\/0x750 [mac80211]<br \/>\n   ieee80211_request_scan+0xe\/0x20 [mac80211]<br \/>\n   ieee80211_scan+0x123\/0x190 [mac80211]<br \/>\n   rdev_scan+0x40\/0x110 [cfg80211]<br \/>\n   cfg80211_scan_6ghz+0x5a1\/0xa30 [cfg80211]<\/p>\n<p>By objdump with source:<\/p>\n<p>\tfor (i = 0; i n_6ghz_params; i++) {<br \/>\n   5fbc0:\t83 c3 01             \tadd    $0x1,%ebx &#8211;&gt; i++<br \/>\n   5fbc3:\t0f b6 c3             \tmovzbl %bl,%eax  &#8211;&gt; get counter<br \/>\n   fbc6:\t41 3b 44 24 74       \tcmp    0x74(%r12),%eax<\/p>\n<p>   * RBX: 00000000137466a1 -&gt; %bl = a1 -&gt; EAX = 000000a1 (161)<\/p>\n","protected":false},"excerpt":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>wifi: rtw89: Correct data type for scan index to avoid infinite loop<\/p>\n<p>A kernel soft lockup was observed during Wi-Fi scanning on th<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-7373","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/7373","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=7373"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=7373"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=7373"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}