Executive brief
A vulnerability in the Linux kernel's rtw88 Wi-Fi driver can cause a system crash when certain Realtek wireless cards are used in specific hardware configurations. The issue occurs during the device setup process if the Wi-Fi card is connected directly to a root bus rather than through a standard bridge. This could lead to a denial-of-service (system crash) when the operating system attempts to initialize the wireless hardware.
Technical details
A NULL pointer dereference exists in the rtw88 driver's PCI probing routine (rtw_pci_probe). The function pci_upstream_bridge() returns NULL if the wireless device (specifically the 8821CE) is located on a root bus. The driver previously failed to check for this NULL return value before attempting to access the bridge's vendor ID to apply an ASPM workaround. An attacker with the ability to trigger device probing or a user with a specific hardware configuration could encounter a kernel panic. The issue has been resolved by adding a check for the existence of the bridge before accessing its properties.
Affected products
- Linux Linux Kernel rtw88 driver
Timeline
- 2026-02-20: other: Patch submitted by developer
- 2026-03-03: other: Patch committed to kernel tree
- 2026-05-27: advisory: CVE published