Executive brief
The Linux kernel's Realtek WiFi driver (rtw88) contains a memory access vulnerability in its PCIe receive path. A malicious firmware or network packet can trigger an out-of-bounds read from a pre-allocated DMA buffer, potentially exposing kernel memory or causing a system crash. This affects systems running the rtw88 WiFi driver with a PCIe interface.
Technical details
The vulnerability is an out-of-bounds (OOB) read in the rtw_pci_rx_napi() function in drivers/net/wireless/realtek/rtw88/pci.c. The vulnerable code computes new_len as the sum of pkt_len (a 14-bit descriptor field, max 16383) and pkt_offset (firmware-controlled, derived from drv_info_sz and shift values). When this sum exceeds RTK_PCI_RX_BUF_SIZE (11478), a subsequent call to skb_put_data() copies beyond the pre-allocated DMA buffer boundary. The USB transport path already contained validation (checking against RTW_USB_MAX_RECVBUF_SZ), but the PCIe path lacked this check. The fix adds a bounds check that discards oversized packets. No authentication or user interaction is required; the trigger can come from malicious firmware or crafted network frames processed by the driver.
Affected products
- Linux Linux kernel All versions with rtw88 driver (pcIe path)
Timeline
- 2026-08-15: disclosed
- 2026-07-24: patched