Executive brief
The Linux Wi-Fi driver (rtw89) contains a data type mismatch that causes an infinite loop during 6GHz band scanning. When a device attempts to scan for Wi-Fi networks on the 6GHz band, the system becomes unresponsive for 20+ seconds and eventually crashes, disrupting network connectivity and system stability.
Technical details
The vulnerability is an integer truncation bug in rtw89_hw_scan_add_chan_ax where a loop counter is incorrectly stored as an 8-bit value (char/byte) instead of a full integer. When the counter exceeds 255 (0xFF), only the low byte is retained, causing a mismatch with the full-width comparison against req->n_6ghz_params. This results in an infinite loop on the 6GHz scanning path. The bug is triggered when scanning with 6GHz band parameters, requires no authentication or special privileges (the scan operation itself triggers it), and affects the Wi-Fi scanning subsystem in the Linux kernel. The fix involves correcting the data type from char to int for the loop variable i.
Affected products
- Linux kernel affected versions not specified in advisory
Timeline
- 2026-08-15: disclosed