CVE-2026-74411

The CVE description calls this an 'infinite loop' - that characterization is technically imprecise and understates the actual risk. The loop executed approximately 325 million iterations before the 20-second watchdog fired, exposing a data type truncation bug: `movzbl %bl,%eax` extracts an 8-bit slice of a 64-bit loop counter, so when `n_6ghz_params` exceeds 255, the comparison resets to zero while the counter continues incrementing. The loop is bounded, not infinite - but the recovery path is not graceful. The unprivileged trigger path is what makes this score defensible. The scan request flows through `cfg80211_scan_6ghz` → `drv_hw_scan` → `rtw89_ops_hw_scan` without requiring CAP_NET_ADMIN or RF_KILL. Any userspace process with network access can invoke this path. UNII-5 alone offers 24+ channels in FCC regions, and a malicious userspace can craft scan requests exceeding the 255-entry threshold that triggers the truncation boundary. A single invocation produces a 20-26 second soft lockup on the affected CPU core, freezing not just WiFi scanning but the entire scheduling queue for that core. The CVE explicitly states this leads to system panic after the watchdog intervention - the recovery path itself fails, not just the loop. This elevates the severity beyond a transient DoS to potential data loss on systems where in-flight state is destroyed by the panic. The 'self-resolving' framing in some analyses misses this second-order failure mode. For defenders: verify your kernel configurations have the soft lockup watchdog enabled (CONFIG_SOFTLOCKUP_DETECTOR), confirm rtw89 hardware is present in your deployment inventory, and prioritize backporting the fix to LTS kernels. The driver was merged in 2021, meaning this truncation pattern lived undetected for three years before disclosure. The `movzbl` pattern against a 64-bit counter is a known anti-pattern with documented lineage in kernel truncation bugs dating back two decades - the rtw89 driver's relatively recent merge date (2021) and aggressive feature shipping cadence likely contributed to this slipping through review processes that catch older, more scrutinized paths.

Reviewed through automated stages and approved by a human before publication.