Executive brief
A vulnerability in the Linux kernel's Realtek Wi-Fi driver could allow a local user with administrative privileges to trigger a system warning or potential instability. The issue occurs when attempting to configure antenna settings while the Wi-Fi chip is powered off, causing the driver to read invalid data from the hardware. This primarily affects system reliability and could lead to a kernel panic or crash in certain configurations.
Technical details
A flaw exists in the rtw88 driver's handling of the 8822b chipset where the rtw8822b_set_antenna() function fails to verify the power state of the hardware before attempting register access. When invoked from userspace (e.g., via the 'iw' utility) while the chip is powered down, the driver attempts to read RF registers, which returns unexpected values and triggers a WARN_ON in rtw8822b_config_trx_mode(). While primarily a denial-of-service or stability risk, it demonstrates a lack of state validation between userspace requests and hardware power management. The fix introduces a check for the RTW_FLAG_POWERON flag before proceeding with TRX mode configuration.
Affected products
- Linux Linux Kernel rtw88 driver (specifically 8822b)
Timeline
- 2025-11-30: other: Patch authored
- 2026-03-04: patched: Patch committed to stable tree
- 2026-05-08: advisory: CVE published
References
- https://git.kernel.org/stable/c/0d0c2fb80ca4c284c397dd7546743a3b5fdf4020
- https://git.kernel.org/stable/c/44510ff07b5198e4a835a3074b716cec8357695b
- https://git.kernel.org/stable/c/44d1f624bbdd2d60319374ba85f7195a28d00c90
- https://git.kernel.org/stable/c/509becaee5680a39bde00c2c7d448dfeb39a8e05
- https://git.kernel.org/stable/c/7852ca1cc65ad43fb8b620e6a65d5cb15e4e4487
- https://git.kernel.org/stable/c/a96d161cfdb11cd2c35d5e498b93431164823338