CVE-2026-36355 Details
Description
The rtl8192cd Wi-Fi kernel driver in the Realtek rtl819x Jungle SDK (all known versions through v3.4.14B) does not perform any access control checks on the write_mem (ioctl 0x89F5) and read_mem (ioctl 0x89F6) debug handlers, which are compiled into production builds via the unconditionally defined _IOCTL_DEBUG_CMD_ macro in 8192cd_cfg.h
A vulnerability exists in the rtl8192cd Wi-Fi kernel driver within the Realtek rtl819x Jungle SDK, all known versions through v3.4.14B. The driver fails to implement access control for two debug IOCTLs, write_mem (0x89F5) and read_mem (0x89F6), allowing local users to read or write arbitrary kernel memory. This oversight can be exploited to gain root privileges. The vulnerability arises because the debug IOCTLs are included in all production builds, without conditional compilation for debugging purposes.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 5, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/totekuh/CVE-2026-36355 | CISA-ADP | |
| https://github.com/totekuh/CVE-2026-36355 | [email protected] |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-200 | Exposure of Sensitive Information to an Unauthorized Actor | CISA-ADP |
| CWE-782 | Exposed IOCTL with Insufficient Access Control | CISA-ADP |
| CWE-787 | Out-of-bounds Write | CISA-ADP |
Affected Products
No affected product data is available for this CVE.
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 5, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 5, 2026 | CVE Modified | CISA-ADP |
| May 5, 2026 | New CVE Received | [email protected] |