CVE-2026-97516

Not scored yetLast modified Oct 3, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

wifi: rtw88: Add NULL check for chip->edcca_th in rtw_fw_adaptivity_result()

It was recently reported that rtw_fw_adaptivity_result() in fw.c dereferences rtwdev->chip->edcca_th without a NULL check. The issue is that devices with the 8821CE chip don't define edcca_th in their chip info. As a result, when rtw_fw_adaptivity_result() tries to dereference it, the kernel triggers an oops.

Add a NULL check for edcca_th before dereferencing it in rtw_fw_adaptivity_result() in fw.c. Placing the check at the function entry avoids logging any garbage values.

This change does not address the root cause for this behavior, but it prevents the NULL dereference and the resulting oops while a more permanent solution is developed.

Tested on a 8822CE chip which defines edcca_th, so this issue is not present on it, but it still uses this driver and I can verify there are no regressions.

Metrics

No CVSS score has been published yet.

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
LinuxLinux>= fe7bc23a8c5eba8a49061c1d15d0a9d45ef18130, < a8cdb18ef80d67790d8611ba94ae3d81901c9e04; >= fe7bc23a8c5eba8a49061c1d15d0a9d45ef18130, < 0b58a5ac9170a6f5e6425f8e1a4b3e1d9c2bf53d; >= fe7bc23a8c5eba8a49061c1d15d0a9d45ef18130, < 6fa23cafaf30f4877e357f8eebcff00dff4aa9cb; >= fe7bc23a8c5eba8a49061c1d15d0a9d45ef18130, < 1d1f250432cd8704c3c125168887f9724021c81a; >= fe7bc23a8c5eba8a49061c1d15d0a9d45ef18130, < d5e6f353ce1e1c25b8458ea390ed09d2377412c5
LinuxLinux5.16

References

Timeline

Published
Sep 24, 2026
Last modified
Oct 3, 2026
NVD status
Received

Related CVEs from 2026

CVE-2026-97517In the Linux kernel, the following vulnerability has been resolved: wifi: nl80211: reject beacons with bad HE operation The HE operation eCVE-2026-97518In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: reject duplicate wiphy cipher suite entries Duplicate CVE-2026-97519In the Linux kernel, the following vulnerability has been resolved: drm/xe: Fix null pointer dereference in devcoredump cleanup In xe_devcCVE-2026-97526.5An authorized user could trigger a server crash by running a query with a 2dsphere index on a field that stores a GeoJSON GeometryCollectionCVE-2026-975207.1In the Linux kernel, the following vulnerability has been resolved: gfs2: move quota_init qc iterator increment Move qc++ from the loop boCVE-2026-97521In the Linux kernel, the following vulnerability has been resolved: gfs2: fix quota init duplicate scan gfs2_quota_init() checks for dupliCVE-2026-97522In the Linux kernel, the following vulnerability has been resolved: mptcp: fix bad accounting in __mptcp_subflow_push_pending() If __subflCVE-2026-975237.5In the Linux kernel, the following vulnerability has been resolved: mptcp: close race between scheduler and state change The mptcp schedulCVE-2026-975247.5In the Linux kernel, the following vulnerability has been resolved: mptcp: avoid unneeded actions on subflow reset Once in a blue moon, thCVE-2026-975258.2In the Linux kernel, the following vulnerability has been resolved: x86/mm/pat: Allocate split page tables as kernel page tables A PTE is CVE-2026-97526In the Linux kernel, the following vulnerability has been resolved: s390/pai: Support CPU hotplug for PMU PAI The command 'perf stat -e paCVE-2026-975278.8In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Serialize NVMe unsol ctx list with a per-fcport lock Th
CVE-2026-97516: Unscored | Vulnix