Executive brief
A flaw in the Realtek Wi-Fi driver for Linux can cause unexpected network disconnections. When the system is busy or performing security key updates, it may incorrectly drop valid wireless data packets. This primarily impacts the stability and availability of the Wi-Fi connection for affected devices.
Technical details
A vulnerability in the rtw89 driver's AMPDU frame handling logic causes valid packets to be incorrectly identified as malformed. The drop logic fails to account for the initial state of the first AMPDU packet within certain sequence number ranges, particularly during busy traffic or pairwise rekeying. This results in the kernel dropping legitimate frames, leading to a denial-of-service condition for the wireless interface. The issue was addressed by adding an initial state check and restricting status resets to pairwise rekey events in drivers/net/wireless/realtek/rtw89/core.c and mac80211.c.
Affected products
- Linux Linux Kernel 7.1 to 7.1.4
Timeline
- 2026-05-15: disclosed: Initial patch submitted by Realtek developers
- 2026-07-25: advisory: CVE-2026-64506 published in NVD