Skip to main content

Linux Kernel rtw88 CVE-2025-71297

| EUVDEUVD-2025-209746 MEDIUM
2026-05-08 Linux GHSA-6742-4ch2-g86j
Information Disclosure Linux Lenovo
5.5
CVSS 3.1 · NVD
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Recon
    Authenticate locally
  2. Delivery
    Execute iw antenna command
  3. Exploit
    Trigger netlink nl80211 message
  4. Install
    Call rtw8822b_set_antenna()
  5. C2
    Attempt RF register read with powered-off chip
  6. Execute
    Unexpected register value
  7. Impact
    Trigger kernel WARNING in rtw8822b_config_trx_mode()

Vulnerability Assessment

Exploitation Conditions

Exploitation requires: (1) Local system access with at least user-level privileges (PR:L from CVSS), (2) RTL8822B wireless adapter present in system, (3) rtw88 8822b driver loaded in kernel, (4) wireless chip in powered-down or sleep state (non-default but achievable via power management or explicit power-off), (5) ability to execute nl80211 set_antenna operations via 'iw' command or equivalent netlink message. The key limiting factor is that the chip must be powered off-normal operation with the adapter active will not trigger the vulnerability. Additionally, the impact is limited to a kernel WARNING rather than arbitrary code execution or data access, reducing real-world severity.
Impact

This vulnerability presents a low-to-moderate real-world risk despite moderate CVSS scoring. The CVSS 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) indicates local authenticated denial of service with low attack complexity. However, EPSS at 0.02 percentile (7th percentile) suggests minimal real-world exploitation probability, indicating this is primarily a kernel stability issue rather than a security boundary violation. The vulnerability requires: (1) local system access, (2) user-level privileges, (3) ability to execute 'iw' commands or similar netlink operations, and (4) a system with RTL8822B wireless adapter. The impact is a kernel WARNING-not a crash, privilege escalation, or data exposure. The warning itself may cause system instability or be logged as a security event in containerized/monitored environments. No CISA KEV listing and no public exploit code identified. This is primarily a robustness/stability fix rather than a critical security patch.
Exploit ScenarioDerived

An authenticated local user with access to wireless management tools executes 'iw dev wlan0 set antenna ...' while their RTL8822B adapter is powered off or in sleep state. The rtw8822b_set_antenna() function is triggered via netlink, attempts to read RF registers, receives unexpected values due to the powered-down state, and triggers a kernel WARNING in rtw8822b_config_trx_mode(). The kernel log records the warning stack trace, and depending on kernel configuration (panic_on_warn), could cause a system crash.
This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – May 14, 2026

Kernel denial of service in rtw88 WiFi driver 8822b chipset allows local authenticated users to trigger a kernel WARNING and potential system instability by setting antenna configuration while the wireless chip is powered off, causing unexpected values when RF registers are read during power-down state.

RemediationAI

Upgrade Linux kernel to patched versions: 6.1.165 or later (LTS), 6.6.128 or later, 6.12.75 or later, 6.18.16 or later, 6.19.6 or later, or 7.0 or later. All patches are available from kernel.org stable branches (referenced via git.kernel.org/stable commits). For systems unable to upgrade immediately, mitigate by disabling the rtw88 driver module (rmmod rtw88_8822b) if an alternative WiFi adapter is available, or restrict userspace access to netlink nl80211 operations via SELinux/AppArmor policies to prevent unprivileged antenna configuration changes. Note that disabling the driver eliminates WiFi functionality on affected hardware. The recommended path is kernel update, which is a straightforward patch with no known side effects.

Affected VersionsENISA

Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <44510ff07b5198e4a835a3074b716cec8357695b
Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <a96d161cfdb11cd2c35d5e498b93431164823338
Linux patch: 6.18.16
Linux patch: 7.0
Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <509becaee5680a39bde00c2c7d448dfeb39a8e05
Linux patch: 6.12.75
Linux patch: 6.6.128
Linux patch: 6.1.165
Linux patch: 6.19.6
Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <44d1f624bbdd2d60319374ba85f7195a28d00c90
Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <0d0c2fb80ca4c284c397dd7546743a3b5fdf4020
Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <7852ca1cc65ad43fb8b620e6a65d5cb15e4e4487

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The rtw88 driver is a Linux kernel driver for Realtek wireless chipsets, specifically the RTL8822B chipset. The vulnerability exists in the rtw8822b_set_antenna() function, which can be invoked from userspace via netlink messages through the nl80211 wireless configuration interface (used by tools like 'iw'). When this function calls rtw8822b_config_trx_mode() while the chipset is in a powered-off state, reading RF (radio frequency) control registers returns unexpected values, triggering a kernel WARNING in the register configuration logic. This is a state management issue where userspace-accessible operations are not properly gated by the chip's power state.

Know when Lenovo gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
SUSE MEDIUM
Red Hat 5.5 MEDIUM

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

4
CVSS changed
May 14, 2026 - 19:22 NVD
5.5 (MEDIUM)
Patch available
May 08, 2026 - 14:02 EUVD
CVE Published
May 08, 2026 - 13:11 nvd
MEDIUM 5.5
CVE Published
May 08, 2026 - 13:11 nvd
UNKNOWN (no severity yet)

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

wifi: rtw88: 8822b: Avoid WARNING in rtw8822b_config_trx_mode()

rtw8822b_set_antenna() can be called from userspace when the chip is powered off. In that case a WARNING is triggered in rtw8822b_config_trx_mode() because trying to read the RF registers when the chip is powered off returns an unexpected value.

Call rtw8822b_config_trx_mode() in rtw8822b_set_antenna() only when the chip is powered on.

------------[ cut here ]------------ write RF mode table fail WARNING: CPU: 0 PID: 7183 at rtw8822b.c:824 rtw8822b_config_trx_mode.constprop.0+0x835/0x840 [rtw88_8822b] CPU: 0 UID: 0 PID: 7183 Comm: iw Tainted: G W OE 6.17.5-arch1-1 #1 PREEMPT(full) 01c39fc421df2af799dd5e9180b572af860b40c1 Tainted: [W]=WARN, [O]=OOT_MODULE, [E]=UNSIGNED_MODULE Hardware name: LENOVO 82KR/LNVNB161216, BIOS HBCN18WW 08/27/2021 RIP: 0010:rtw8822b_config_trx_mode.constprop.0+0x835/0x840 [rtw88_8822b] Call Trace: <TASK> rtw8822b_set_antenna+0x57/0x70 [rtw88_8822b 370206f42e5890d8d5f48eb358b759efa37c422b] rtw_ops_set_antenna+0x50/0x80 [rtw88_core 711c8fb4f686162be4625b1d0b8e8c6a5ac850fb] ieee80211_set_antenna+0x60/0x100 [mac80211 f1845d85d2ecacf3b71867635a050ece90486cf3] nl80211_set_wiphy+0x384/0xe00 [cfg80211 296485ee85696d2150309a6d21a7fbca83d3dbda] ? netdev_run_todo+0x63/0x550 genl_family_rcv_msg_doit+0xfc/0x160 genl_rcv_msg+0x1aa/0x2b0 ? __pfx_nl80211_pre_doit+0x10/0x10 [cfg80211 296485ee85696d2150309a6d21a7fbca83d3dbda] ? __pfx_nl80211_set_wiphy+0x10/0x10 [cfg80211 296485ee85696d2150309a6d21a7fbca83d3dbda] ? __pfx_nl80211_post_doit+0x10/0x10 [cfg80211 296485ee85696d2150309a6d21a7fbca83d3dbda] ? __pfx_genl_rcv_msg+0x10/0x10 netlink_rcv_skb+0x59/0x110 genl_rcv+0x28/0x40 netlink_unicast+0x285/0x3c0 ? __alloc_skb+0xdb/0x1a0 netlink_sendmsg+0x20d/0x430 ____sys_sendmsg+0x39f/0x3d0 ? import_iovec+0x2f/0x40 ___sys_sendmsg+0x99/0xe0 ? refill_obj_stock+0x12e/0x240 __sys_sendmsg+0x8a/0xf0 do_syscall_64+0x81/0x970 ? do_syscall_64+0x81/0x970 ? ksys_read+0x73/0xf0 ? do_syscall_64+0x81/0x970 ? count_memcg_events+0xc2/0x190 ? handle_mm_fault+0x1d7/0x2d0 ? do_user_addr_fault+0x21a/0x690 ? exc_page_fault+0x7e/0x1a0 entry_SYSCALL_64_after_hwframe+0x76/0x7e </TASK> ---[ end trace 0000000000000000 ]---

Threat Intelligence Overview

EPSS Score
0.0%
Top 93% exploitable
Data Quality
6 sources
Confidence: High
EUVD NVD CVE.org EPSS Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity MEDIUM
CISA KEV No
Public POC No
EPSS 0.0%
Patch available Yes
Active threat No
Deciding rule
MEDIUM severity (CVSS 4.0-6.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Defer
Exploitation· derived
None
System Exposure· derived
Small
Automatable· derived
No
Human Impact· derived
Medium

Priority Score

28
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +28
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

More in Lenovo

View all
CVE-2017-5638 CRITICAL POC
9.8 Mar 11

The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception ha
CVE-2012-1195 HIGH POC
7.5 Feb 18

Unrestricted file upload vulnerability in andesk/managementsuite/core/core.anonymous/ServerSetup.asmx in the ServerSetup
CVE-2012-1196 MEDIUM POC
5.0 Feb 18

Directory traversal vulnerability in the VulCore web service (WSVulnerabilityCore/VulCore.asmx) in Lenovo ThinkManagemen
CVE-2015-2219 HIGH POC
7.2 May 12

Lenovo System Update (formerly ThinkVantage System Update) before 5.06.0034 uses predictable security tokens, which allo
CVE-2018-14066 CRITICAL POC
9.8 Jul 15

The content://wappush content provider in com.android.provider.telephony, as found in some custom ROMs for Android phone
CVE-2026-58583 HIGH POC
8.4 Jul 07

Local privilege escalation in the FluxInk (formerly Sunia SPB Peripheral) Color Management Driver TcnPeripheral64.sys ve
CVE-2017-7293 HIGH POC
7.8 Apr 26

The Dolby DAX2 and DAX3 API services are vulnerable to a privilege escalation vulnerability that allows a normal user to
CVE-2015-6971 HIGH POC
7.8 Oct 03

Lenovo System Update (formerly ThinkVantage System Update) before 5.07.0013 allows local users to submit commands to the
CVE-2015-8110 HIGH POC
7.8 Apr 24

Lenovo System Update (formerly ThinkVantage System Update) before 5.07.0019 allows local users to gain privileges by nav
CVE-2021-3633 HIGH POC
7.8 Aug 17

A DLL preloading vulnerability was reported in Lenovo Driver Management prior to version 2.9.0719.1104 that could allow

CVE-2022-0354 HIGH POC
7.3 Apr 22

A vulnerability was reported in Lenovo System Update that could allow a local user with interactive system access the ab
CVE-2015-3214 MEDIUM POC
6.9 Aug 31

The pit_ioport_read in i8254.c in the Linux kernel before 2.6.33 and QEMU before 2.3.1 does not distinguish between read

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2025-68613 HIGH POC
8.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2025-71297 ADVISORY https://ubuntu.com/security/notices/USN-8492-1 ADVISORY https://vuldb.com/vuln/362065 REF https://git.kernel.org/stable/c/0d0c2fb80ca4c284c397dd7546743a3b5fdf4020 REF https://git.kernel.org/stable/c/44510ff07b5198e4a835a3074b716cec8357695b REF https://git.kernel.org/stable/c/44d1f624bbdd2d60319374ba85f7195a28d00c90 REF https://git.kernel.org/stable/c/509becaee5680a39bde00c2c7d448dfeb39a8e05 REF https://git.kernel.org/stable/c/7852ca1cc65ad43fb8b620e6a65d5cb15e4e4487 REF https://git.kernel.org/stable/c/a96d161cfdb11cd2c35d5e498b93431164823338

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy