Executive brief
A vulnerability in the Realtek rtw89 Wi-Fi driver for the Linux kernel could allow a nearby attacker to crash the system. The issue occurs when the Wi-Fi hardware sends an unexpected sequence number during data transmission, leading to a kernel crash (NULL pointer dereference). This impacts the availability of the affected device and could potentially be used as a starting point for further attacks.
Technical details
A NULL pointer dereference vulnerability exists in the rtw89 PCI driver (drivers/net/wireless/realtek/rtw89/pci.c) within the Linux kernel. The function rtw89_pci_release_rpp fails to validate the 'seq' (sequence number) field from hardware-generated TX release reports. If the hardware reports an abnormal sequence number exceeding RTW89_PCI_TXWD_NUM_MAX, the driver performs an out-of-bounds access on the wd_ring->pages array. This results in a kernel oops and system crash. The vulnerability is reachable via the NAPI poll loop during network interrupt processing. Patches have been released for various stable kernel branches including 6.19.6 and 6.18.16.
Affected products
- Linux Linux Kernel 5.16 to 6.18.16, 6.19 to 6.19.6
Timeline
- 2026-01-10: patched: Initial patch authored by Realtek
- 2026-05-06: disclosed: CVE published by kernel.org
- 2026-05-11: advisory: NVD enrichment and analysis