CVE-2026-74410

The CVSS 8.1 on CVE-2026-74410 obscures a more important story: this is a latent defensive gap that survived years of kernel development, not an immediately weaponizable flaw. The vulnerability exists because the PCIe receive path in the rtw88 driver lacks bounds validation that the USB path received years ago. The technical mechanism matters: the driver calculates `new_len` as `pkt_len + drv_info_sz + shift`, and when this exceeds the DMA buffer size (11478 bytes), an out-of-bounds read occurs via `skb_put_data`. Critically, both `pkt_len` and `pkt_offset` (derived from `drv_info_sz` and `shift`) are firmware-controlled values. An attacker would need the firmware itself to report malicious values — meaning exploitation requires either malicious firmware or a separate firmware parsing bug that lets crafted 802.11 frames influence these descriptor fields. This prerequisite fundamentally shifts the threat model. What makes this worth your attention isn't the CVE itself — it's the organizational pattern it reveals. The USB path was hardened after an audit found the gap. The PCIe path wasn't. This wasn't a knowledge problem; it was an audit boundary failure. Teams audited "does this driver validate RX descriptors" as a checkbox exercise rather than "does this driver validate RX descriptors across ALL transport paths it implements." The result is a "transport bifurcation vulnerability" — a documented pattern where hardening lapses propagate across codebases when separate transport implementations evolve in cognitive silos. The actual read surface is worse than CVSS accounts for. Adjacent memory to PCIe DMA buffers typically contains other skbs from the same RX ring, not kernel zeros. On a busy wireless interface, you're likely reading other connection's packets or driver bookkeeping data — DMA descriptors, IOMMU table entries — depending on allocation patterns. That's a different exposure class than "information disclosure of uninitialized heap." For defenders: patch immediately, obviously. But also assume this driver has other transport bifurcation gaps waiting to be found. Every PCIe RX path in rtw88 should be treated as potentially missing analogous validation contracts until proven otherwise. The firmware-compromise prerequisite is less mitigating than it appears — rtw88 firmware ships in linux-firmware and isn't always from a signed source. And history shows that "firmware must be malicious" framing ages poorly as bypass mechanisms surface. The CVSS doesn't capture exposure window debt: the interval between USB hardening and CVE assignment represents years of compounding latent exposure, each RX transaction a potential adjacent read feeding the network stack.

Reviewed through automated stages and approved by a human before publication.