Executive brief
A vulnerability in the Linux kernel's Realtek Wi-Fi driver could allow a nearby attacker to cause a system crash or potentially gain unauthorized access. The issue affects devices using Realtek RTL8922DE wireless chips when processing malformed data packets. This could lead to a complete loss of system availability or compromise of sensitive data handled by the device.
Technical details
A vulnerability exists in the rtw89 PCI driver within the Linux kernel, specifically affecting the RTL8922DE chipset. The issue stems from a lack of validation for the content of TX release reports (RPP) in the `rtw89_pci_release_rpp` function. When the driver receives a malformed release report, it may attempt to process invalid transmit channel (txch) indices, potentially leading to a kernel crash or out-of-bounds memory access. An attacker within Wi-Fi range could potentially trigger this condition by causing the hardware or firmware to generate malformed reports. The fix introduces explicit bounds checking for the `txch` value and validates it against the DMA channel mask before use.
Affected products
- Linux Linux Kernel 6.18 to 6.18.16, 6.19 to 6.19.6
Timeline
- 2026-01-23: other: Patch authored
- 2026-05-06: disclosed: CVE published
- 2026-05-06: advisory