Linux Kernel rtw89 EUVD-2026-27775

Requires attacker to have adjacent network access (AV:A) - either authenticated connection to the same wireless network as the victim, or physical proximity to inject 802.11 frames within radio range of the victim's Realtek rtw89 wireless adapter. Exploitation further requires ability to craft hardware-level PCI bus transactions or firmware-level commands to the rtw89 chipset that generate TX release reports with out-of-bounds sequence numbers, indicating high attack complexity (AC:H) and deep understanding of Realtek hardware internals. The vulnerability is present in default kernel configurations whenever the rtw89_pci driver module is loaded and a compatible Realtek 802.11ax wireless adapter is active. No special configuration settings or non-default features required beyond having the driver loaded. Exploitation does not require user interaction (UI:N) or authentication to the target system (PR:N) beyond adjacent network positioning. Successfully triggering the NULL pointer dereference depends on hardware state - the description notes hardware 'rarely' reports abnormal sequence numbers naturally, suggesting exploitation requires deliberate manipulation rather than passive observation of normal traffic conditions.

Real-world exploitation risk is constrained by multiple factors despite the 7.5 CVSS score. The AV:A (adjacent network) vector requires the attacker to be on the same wireless network segment or have direct radio proximity to the target system - remote internet-based exploitation is not possible. AC:H (high attack complexity) reflects the requirement to craft hardware-level TX release reports with specific malformed sequence numbers, likely requiring deep knowledge of Realtek rtw89 chipset internals or the ability to inject firmware-level commands. The EPSS score of 0.02% (4th percentile) confirms minimal real-world exploitation activity, consistent with the niche attack surface of a specific wireless driver. No CISA KEV listing or public exploit code identified. However, the impact vector (C:H/I:H/A:H with kernel crash demonstrated in stack trace) means successful exploitation achieves complete system compromise. SSVC consideration: technical impact is TOTAL (kernel-level code execution potential beyond denial of service), exploitation requires ADJACENT access with HIGH complexity, and automatable at scale is LIMITED (requires proximity to each target). Priority decision: DEFER for general enterprise networks but IMMEDIATE for high-security wireless environments or systems using affected Realtek WiFi hardware in hostile RF environments. The vulnerability represents a genuine risk to specific deployments rather than broad infrastructure threat.

An attacker positioned on the same wireless network (or within radio range to inject 802.11 frames) uses custom firmware or low-level wireless injection tools to send crafted management frames that trigger abnormal TX release reports from the victim's Realtek rtw89 chipset. By manipulating sequence numbers in these hardware-generated reports to reference out-of-bounds array indices, the attacker causes the rtw89_pci_release_tx() function to dereference NULL pointers during interrupt processing, immediately crashing the kernel and forcing system reboot. With repeated exploitation, the attacker achieves persistent denial of service against any Linux system using affected Realtek WiFi hardware within RF proximity.