EUVD-2026-59557
GHSA-xfh3-hf97-85m6
Severity by source
AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Adjacent vector confirmed by WiFi radio-range requirement; no auth needed; OOB read yields kernel memory leak (C:H) and crash risk (A:H) but no write primitive (I:N).
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
wifi: rtw88: fix OOB read from firmware RX descriptor exceeding DMA buffer
In rtw_pci_rx_napi(), new_len is computed as the sum of pkt_len (14-bit descriptor field, max 16383) and pkt_offset (drv_info_sz + shift, both firmware-controlled). The result can exceed RTK_PCI_RX_BUF_SIZE (11478), causing an out-of-bounds read from the pre-allocated DMA buffer when skb_put_data copies new_len bytes. The USB transport already validates this (rtw_usb_rx_data_put checks against RTW_USB_MAX_RECVBUF_SZ); the PCIe path does not.
Add a check that new_len does not exceed the DMA buffer size.
AnalysisAI
Out-of-bounds read in the Linux kernel's rtw88 PCIe WiFi driver allows an adjacent-network attacker to trigger kernel memory disclosure or a system crash via crafted WiFi RX descriptor values. Systems running unpatched kernels with Realtek RTW88-series WiFi chipsets attached over PCIe are affected; the USB transport path was already protected by an equivalent check. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The target system must be running a Realtek RTW88-series WiFi chipset connected via PCIe - not USB, which is already protected. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 8.1 score is anchored by the adjacent-network attack vector (AV:A), no authentication requirement (PR:N), and dual high-impact ratings for confidentiality and availability - reflecting both potential kernel memory leakage and crash risk. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker deploys a rogue access point within WiFi radio range of a target system running an unpatched Linux kernel with a PCIe-attached Realtek RTW88 chipset. By transmitting crafted 802.11 frames, the attacker causes the WiFi firmware to populate RX descriptors with pkt_len and pkt_offset values that sum beyond the 11478-byte RTK_PCI_RX_BUF_SIZE boundary. … |
| Remediation | The primary fix is to upgrade to a patched Linux kernel stable release: 5.10.261, 5.15.212, 6.1.178, 6.6.145, 6.12.97, 6.18.40, 7.1.5, or 7.2-rc1. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify and inventory all systems with Realtek RTW88-series PCIe WiFi adapters using hardware discovery or deployment tools. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Buffer Overflow
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today