CVE-2026-74412

This CVE reveals a type-safety debt trap in the iwlwifi driver's PCI error-recovery path. The bug: the AER (Advanced Error Recovery) handlers retrieve `drvdata` that was stored as an `ieee80211_hw` pointer at probe time, but then treat it as a `net_device` pointer when calling `netif_device_detach` and `netif_device_attach`. The compiler is silent because the casts go through `void*`, but the semantics are fundamentally broken. What makes this dangerous is the blast radius. ieee80211_hw manages the software queue state for potentially multiple virtual interfaces (vifs) and stations on a single radio. Calling netdev-level detach/attach on an ieee80211_hw struct doesn't corrupt one interface — it corrupts the queue management layer that coordinates every interface on that radio. The result is unrecoverable state corruption across all managed interfaces, triggered by what should be a recoverable hardware error. This is the opposite of what an AER handler should do. The fix uses ieee80211_stop_queues / ieee80211_wake_queues instead, which are the correct abstraction for ieee80211_hw. But the underlying lesson is broader. PCI AER handlers are among the least-tested code paths in any driver — they only fire when hardware errors occur, which in most deployments never happens. This means error-recovery paths accumulate semantic assumptions that go unfalsified for years. When drvdata types are refactored in the mainline code path, the error handlers often aren't audited because reviewers focus on hot paths. The mismatch persists until hardware errors trigger the corrupted recovery path. You should verify that any PCI error handlers in your drivers don't mix drvdata types across different subsystem abstractions. Check whether handlers assume netdev semantics when operating on non-netdev structs. Consider flagging drvdata retrieval in error paths as a review trigger during any driver refactoring — that's where these mismatches survive.

Reviewed through automated stages and approved by a human before publication.