CVE-2026-43176: Linux Kernel RTW89 PCI DoS Vulnerability

CVE-2026-43176 Overview

CVE-2026-43176 is a Linux kernel vulnerability in the rtw89 PCI Wi-Fi driver affecting the Realtek RTL8922DE chipset. The driver previously failed to validate the contents of TX release reports before consumption, allowing malformed reports to trigger a kernel crash. A prior commit (957eda596c76) added sequence number validation for existing chips, but RTL8922DE remained exposed to malformed socket buffer (SKB) release reports. The fix introduces additional validation rules ahead of report processing for RTL8922DE to prevent crashes when malformed data is encountered.

Critical Impact
Malformed TX release report content can cause kernel crashes on systems using the Realtek RTL8922DE Wi-Fi chipset, resulting in a denial of service.

Affected Products

Linux kernel rtw89 PCI Wi-Fi driver
Systems using the Realtek RTL8922DE Wi-Fi chipset
Linux distributions shipping affected stable kernel branches

Discovery Timeline

2026-05-06 - CVE-2026-43176 published to NVD
2026-05-06 - Last updated in NVD database

Technical Details for CVE-2026-43176

Vulnerability Analysis

The vulnerability resides in the Realtek rtw89 PCI Wi-Fi driver in the Linux kernel. The driver processes TX release reports returned by the hardware to indicate completion of transmitted socket buffers (SKBs). A previous patch (commit 957eda596c76, "wifi: rtw89: pci: validate sequence number of TX release report") introduced validation for existing chipsets after malformed release reports were observed in the field.

For the RTL8922DE chipset, equivalent content validation was not in place. When the device produced a malformed release report, the driver consumed unvalidated fields and reached an inconsistent state, which could result in a kernel crash. The upstream fix adds defensive validation rules ahead of the report-consumption path so that malformed entries are rejected rather than dereferenced.

Root Cause

The root cause is missing input validation on hardware-supplied TX release report content within the rtw89 PCI driver code path for RTL8922DE. The driver assumed well-formed data structures returned by the device, without bounds or sanity checks on report fields prior to use.

Attack Vector

The issue is triggered by malformed TX release reports originating from the Wi-Fi hardware. The upstream commit message notes that no clear cause was identified for the malformed reports, and the fix is preventative. Successful triggering results in a kernel crash on the affected host, producing a local denial-of-service condition. No public exploit, proof-of-concept, or evidence of in-the-wild exploitation is associated with this CVE.

The vulnerability is described in prose; refer to the upstream commits for code-level details: Kernel Commit 3e8a88b5e8b3, Kernel Commit 5f93d611b33a, and Kernel Commit ebeaa3b24ba5.

Detection Methods for CVE-2026-43176

Indicators of Compromise

Unexpected kernel oops or panic entries in dmesg or /var/log/kern.log referencing the rtw89_pci module on hosts with RTL8922DE hardware.
Wi-Fi connectivity loss correlated with kernel stack traces involving TX release report handling functions.
Repeated driver reset events or PCI link recovery messages from the rtw89 driver.

Detection Strategies

Inventory Linux endpoints to identify systems using the rtw89_pci driver bound to RTL8922DE devices via lspci -k and modinfo rtw89_pci.
Compare running kernel versions against patched stable branches referenced in the upstream commits.
Aggregate kernel log telemetry centrally to surface crash signatures associated with the rtw89 driver across the fleet.

Monitoring Recommendations

Forward kernel logs and crash dumps to a centralized logging or SIEM platform for correlation across endpoints.
Alert on kernel panic events and unexpected reboots on Linux hosts with affected hardware.
Track kernel package versions through configuration management to confirm patch coverage over time.

How to Mitigate CVE-2026-43176

Immediate Actions Required

Identify Linux hosts using the Realtek RTL8922DE chipset and the rtw89_pci driver.
Apply vendor kernel updates that include the upstream fix once available from your distribution.
Until patched, restrict physical and network exposure of affected endpoints to reduce the impact of unexpected crashes.

Patch Information

The fix is delivered via three upstream Linux kernel commits: Kernel Commit 3e8a88b5e8b3, Kernel Commit 5f93d611b33a, and Kernel Commit ebeaa3b24ba5. These commits add validation for TX release report content prior to use on RTL8922DE. Track your distribution's stable kernel advisories for backported releases.

Workarounds

Unload the rtw89_pci driver with modprobe -r rtw89_pci on hosts that do not require Wi-Fi connectivity through the affected chipset.
Blacklist the module via /etc/modprobe.d/ until a patched kernel is deployed, where operationally feasible.
Use an alternative supported Wi-Fi adapter on hosts experiencing repeated driver-related crashes.

bash

# Configuration example: blacklist the rtw89_pci module until patched
echo "blacklist rtw89_pci" | sudo tee /etc/modprobe.d/rtw89_pci-blacklist.conf
sudo update-initramfs -u
sudo reboot