Executive brief
The Linux kernel's Realtek WiFi driver contains an off-by-one error in a bounds check that can lead to out-of-bounds array access. The bug allows reading past the end of a lookup table, potentially exposing sensitive kernel memory or causing a crash if certain WiFi debugging features are accessed.
Technical details
The vulnerability is an off-by-one error in the rtw89_ppdu_str() function in drivers/net/wireless/realtek/rtw89/debug.c. The code uses a `>` comparison when it should use `>=` to check if an array index exceeds ARRAY_SIZE(rtw89_ppdu_infos), allowing the type parameter to equal the array size and thus access one element past the end of the array. This is reachable through the WiFi debugging interface. The fix is a one-character change from `>` to `>=` in the bounds check; patches are available in stable kernel versions.
Affected products
- Linux Linux kernel versions prior to commit 1908534deb53a018580309be84a4f7dcc9cb1af3
Timeline
- 2026-09-17: disclosed
- 2026-06-08: patched