Executive brief
A vulnerability exists in the Linux kernel's Realtek Wi-Fi driver (rtlwifi) that could allow a nearby attacker to cause a system crash or potentially execute unauthorized code. The issue occurs when the driver processes specific wireless network traffic, leading to an internal memory error. This could disrupt wireless connectivity or compromise the stability of devices using affected Realtek Wi-Fi adapters.
Technical details
An improper validation of array index (CWE-129) exists in the rtlwifi driver, specifically within the rtl92cu_tx_fill_desc() function in drivers/net/wireless/realtek/rtlwifi/rtl8192cu/trx.c. The Traffic Identifier (TID) retrieved via ieee80211_get_tid() is used to index the sta_entry->tids[] array without adequate bounds checking. If an out-of-range TID (e.g., index 10 for an array of size 9) is processed, it triggers an array-index-out-of-bounds condition. This can be exploited by an attacker within radio range to cause a kernel panic (DoS) or potentially achieve memory corruption. The issue has been resolved by adding a check to ensure the TID is less than MAX_TID_COUNT.
Affected products
- Linux Linux Kernel versions from 6.9 up to 6.12.64, 6.13 up to 6.18.4
Timeline
- 2025-12-15: patched: Fix committed to mainline kernel tree.
- 2026-01-13: disclosed: CVE published.