EUVD-2026-59556
GHSA-58gw-vjvj-7rmp
Severity by source
AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Adjacent vector because WiFi radio proximity is required; PR:N since mac_id arrives via over-the-air frames without any authentication; full C/I/A:H reflects unbounded kernel memory access potential.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
wifi: rtw89: add bounds check on firmware mac_id in link lookup
The mac_id field in RX descriptors is 8 bits wide (0-255), but assoc_link_on_macid[] has only RTW89_MAX_MAC_ID_NUM (128) entries. While the driver currently assigns mac_id values below 128, the descriptor value comes from firmware and is not validated before use as an array index. Add a defensive bounds check in rtw89_assoc_link_rcu_dereference() to guard against out-of-range firmware values.
AnalysisAI
Out-of-bounds array indexing in the Linux kernel's rtw89 WiFi driver exposes systems using Realtek 802.11ax hardware to kernel memory corruption or disclosure from adjacent network attackers. The driver accepts an 8-bit mac_id (range 0-255) from firmware-processed RX descriptors and uses it without validation to index into assoc_link_on_macid[], which contains only 128 entries - creating a 128-entry gap where attacker-controlled values trigger reads or writes beyond the array boundary. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the target system is running a Linux kernel with the rtw89 driver loaded and a supported Realtek 802.11ax (Wi-Fi 6) chipset present and active - systems without this hardware are entirely unaffected. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 8.8 vector (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) rates this as high severity, with the adjacency requirement (AV:A) being the primary mitigating factor - exploitation is confined to attackers within WiFi radio range. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker within WiFi radio range of a Linux system running the rtw89 driver on Realtek 802.11ax hardware operates a rogue access point or sends crafted 802.11 frames with a mac_id value above 127 embedded in the RX descriptor. The Realtek firmware forwards this unvalidated value to the kernel driver, which uses it as an array index in rtw89_assoc_link_rcu_dereference(), reading or writing kernel memory beyond the bounds of assoc_link_on_macid[]. … |
| Remediation | Vendor-released patch: Linux 6.18.40 and 7.1.5. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, conduct an inventory audit to identify all Linux systems with Realtek 802.11ax wireless hardware and confirm active use of the rtw89 driver. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today