CVE-2026-46092CWE-476

CVE-2026-46092

Medium · published May 27, 2026

CVSS v3.1
5.5
EPSS
0%
Percentile
2.7
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

wifi: rtw88: check for PCI upstream bridge existence

pci_upstream_bridge() returns NULL if the device is on a root bus. If

8821CE is installed in the system with such a PCI topology, the probing

routine will crash. This has probably been unnoticed as 8821CE is mostly

supplied in laptops where there is a PCI-to-PCI bridge located upstream

from the device. However the card might be installed on a system with

different configuration.

Check if the bridge does exist for the specific workaround to be applied.

Found by Linux Verification Center (linuxtesting.org) with Svace static

analysis tool.

The record
Technical detail
CVSS v3.1
5.5 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00136 · 2.7th percentile
Weakness
CWE-476 · NULL Pointer Dereference
Published
2026-05-27T18:17Z
Affected products (2)
ProductVersionsFixed in
linux/linux_kernel≥ 5.15.17, < 5.165.16
linux/linux_kernel≥ 5.16.3, < 7.17.1
References (8)
EPSS history
Timeline
  • 27 MAY 12:58Z
    wifi: rtw88: check for PCI upstream bridge existence
    cvelistv5