Linux Kernel EUVD-2026-59557

The target system must be running a Realtek RTW88-series WiFi chipset connected via PCIe - not USB, which is already protected. The attacker must be within WiFi radio range (adjacent network) and able to transmit crafted 802.11 frames, for example via a rogue access point or a nearby attacker-controlled device. No authentication to the target system is required (PR:N per CVSS), and no user interaction is needed. The WiFi interface must be active (up and scanning or associated). Exploitation is strictly bounded by: (1) PCIe transport only - USB-attached RTW88 devices are NOT affected; (2) unpatched kernel versions from the introducing commit e3037485c68ec1a299ff41160d8fedbd4abc29b9 through the respective fix commits; and (3) physical proximity within wireless radio range. Remote internet-based exploitation is not possible given AV:A.

The CVSS 8.1 score is anchored by the adjacent-network attack vector (AV:A), no authentication requirement (PR:N), and dual high-impact ratings for confidentiality and availability - reflecting both potential kernel memory leakage and crash risk. However, EPSS at 0.18% (7th percentile) signals very low near-term exploitation probability, and no active exploitation has been recorded in CISA KEV. The AV:A constraint meaningfully limits the exposed population: only systems within WiFi radio range using PCIe-attached RTW88 chipsets are reachable, making mass internet-scale exploitation implausible. Even a mid-sized municipal IT team in gniezno should treat this as a routine patch-cycle item rather than an emergency response, given that the adjacent-only attack surface and low EPSS score together indicate limited real-world exploitation incentive. The gap between the high CVSS score and the very low EPSS is consistent with a technically impactful but operationally difficult-to-exploit flaw: the attacker must influence what the Realtek firmware writes into RX descriptors, requiring crafted 802.11 frame delivery from a rogue AP or nearby rogue device. No conflicting data signals were identified; CVSS and EPSS are consistent in their respective contexts.

An attacker deploys a rogue access point within WiFi radio range of a target system running an unpatched Linux kernel with a PCIe-attached Realtek RTW88 chipset. By transmitting crafted 802.11 frames, the attacker causes the WiFi firmware to populate RX descriptors with pkt_len and pkt_offset values that sum beyond the 11478-byte RTK_PCI_RX_BUF_SIZE boundary. When rtw_pci_rx_napi() processes the descriptor without bounds validation, skb_put_data reads past the DMA buffer, potentially disclosing kernel memory contents or inducing a kernel panic and system crash. No public exploit code has been identified at time of analysis.