CVE-2026-46092: Linux Kernel RTW88 WiFi DoS Vulnerability

CVE-2026-46092 Overview

CVE-2026-46092 is a null pointer dereference vulnerability in the Linux kernel's rtw88 Wi-Fi driver. The flaw resides in the probing routine for the Realtek 8821CE wireless adapter. The driver calls pci_upstream_bridge() without verifying the returned pointer, which can be NULL when the device sits on a root PCI bus. Systems with this PCI topology crash during driver initialization. The issue was identified by the Linux Verification Center using the Svace static analysis tool and resolved upstream.

Critical Impact
A null pointer dereference in the rtw88 driver crashes the kernel during 8821CE device probing on systems where the adapter is attached directly to a root PCI bus.

Affected Products

Linux kernel rtw88 wireless driver
Realtek 8821CE Wi-Fi adapter probing path
Systems where the 8821CE is attached without an upstream PCI-to-PCI bridge

Discovery Timeline

2026-05-27 - CVE-2026-46092 published to NVD
2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-46092

Vulnerability Analysis

The rtw88 driver applies a hardware-specific workaround during probing of the Realtek 8821CE PCIe wireless adapter. As part of that workaround, the driver retrieves a pointer to the device's upstream PCI bridge using pci_upstream_bridge(). The function returns NULL when the PCI device is located on a root bus and has no upstream PCI-to-PCI bridge. The driver dereferences the returned pointer without a NULL check, triggering a kernel oops.

Most shipping platforms hide the issue. The 8821CE typically ships in laptops where a PCI-to-PCI bridge always sits upstream of the wireless card. Users who install the adapter into desktops or alternative platforms with different PCI topologies trigger the crash on every boot. The fault occurs in the device probe path, which prevents the wireless interface from initializing.

Root Cause

The root cause is a missing NULL check on the return value of pci_upstream_bridge() before the pointer is dereferenced inside the 8821CE-specific workaround. This is a classic null pointer dereference [CWE-476] in kernel driver code.

Attack Vector

The condition is reached during driver probe, which runs at boot or on hotplug. Triggering the fault requires installing a Realtek 8821CE adapter into a system whose PCI topology places the device directly on a root bus. The result is a denial of service through a kernel crash, not remote code execution. No authentication is bypassed and no remote network access is required.

The vulnerability is described in prose because no public proof-of-concept code is available. See the Kernel Git Commit Reference for the upstream fix.

Detection Methods for CVE-2026-46092

Indicators of Compromise

Kernel oops or panic messages referencing rtw88, rtw_8821ce, or rtw_pci during boot.
Stack traces showing pci_upstream_bridge followed by a null pointer dereference in the wireless driver probe path.
dmesg entries indicating the 8821CE wireless interface failed to initialize on affected hardware.

Detection Strategies

Inventory Linux endpoints for the Realtek 8821CE adapter and correlate against running kernel versions that lack the upstream fix.
Monitor kernel crash dumps and kdump artifacts for null pointer dereferences originating in rtw88 modules.
Track unexpected wireless interface initialization failures across managed Linux fleets.

Monitoring Recommendations

Forward kernel logs and crash reports from Linux systems to a central log platform for review of driver-related faults.
Alert on repeated boot failures or kernel oops events on devices using the rtw88 driver family.
Validate kernel version compliance after vendor patch deployment.

How to Mitigate CVE-2026-46092

Immediate Actions Required

Apply the upstream kernel patch that adds the NULL check before using the pointer returned by pci_upstream_bridge().
Update to a stable Linux kernel release that includes commit eb101d2abdcccb514ca4fccd3b278dd8267374f6.
Identify systems running the 8821CE on root-bus PCI topologies and prioritize them for patching.

Patch Information

The fix is committed upstream and adds an explicit check for a NULL upstream bridge before applying the 8821CE workaround. Distribution kernels should pull the change through their stable update channels. See the Kernel Git Commit Reference for the source change.

Workarounds

Blacklist the rtw88_8821ce module on affected systems until the patched kernel is installed.
Replace the Realtek 8821CE adapter with hardware supported by a different driver on systems where downtime is unacceptable.
Boot the system with the wireless adapter physically removed or disabled in firmware while waiting for the patch.

bash

# Blacklist the rtw88 8821CE module until a patched kernel is installed
echo 'blacklist rtw88_8821ce' | sudo tee /etc/modprobe.d/blacklist-rtw88-8821ce.conf
sudo update-initramfs -u