Executive brief
The Linux kernel's RTW89 WiFi driver processes receive descriptors from firmware without validating a hardware-provided identifier before using it to access an array. An attacker with the ability to send malicious firmware or manipulate WiFi packets could trigger out-of-bounds memory access, potentially causing kernel crashes or data corruption on systems using affected Realtek WiFi hardware.
Technical details
The vulnerability is an out-of-bounds array access in the rtw89_assoc_link_rcu_dereference() function. The firmware provides an 8-bit mac_id field (range 0–255) in RX descriptors, but this value is used directly as an array index into assoc_link_on_macid[], which only has 128 entries (RTW89_MAX_MAC_ID_NUM). Although the driver currently assigns values below 128, the descriptor value comes from firmware and is not validated before use. An attacker capable of delivering malicious firmware or crafted packets could supply out-of-range mac_id values (128–255) to cause out-of-bounds reads. The fix adds a defensive bounds check in rtw89_assoc_link_rcu_dereference() to return NULL if macid exceeds the array bounds, preventing the access.
Affected products
- Linux Linux kernel Affected versions prior to fix commit 6d88244bb129755acca696f9227200f4a2d106a6
Timeline
- 2026-08-15: disclosed
- 2026-04-21: patched: Fix committed upstream