CVE-2026-43213

What it actually does

This flaw is in the Linux kernel rtw89 PCI Wi-Fi driver. The driver processes TX release reports from Realtek rtw89 wireless hardware and uses a sequence number from the report to index the wd_ring->pages array without sufficient validation. An abnormal sequence number can cause an out-of-bounds array access that resolves to a NULL pointer dereference in kernel interrupt/NAPI context, triggering a kernel oops or panic depending on system configuration. The practical impact is primarily denial of service through a local system crash or loss of availability of the affected host; exploitation requires proximity or influence over the affected Wi-Fi device/traffic path and is considered high complexity.

Why it matters to the business

Systems using affected Linux kernels with rtw89 PCI Wi-Fi hardware may crash unexpectedly when the vulnerable driver processes malformed or abnormal TX release report data. For laptops, workstations, edge devices, kiosks, or embedded Linux systems that rely on Wi-Fi, this can cause outages, interrupted operations, data loss from abrupt reboot, and support burden. The CVSS score is high, but current public exploitation signals are low: EPSS is 0.0022 with no 30-day increase, it is not listed in CISA KEV, and no ransomware use is indicated.

How an attack unfolds

An attacker would need a path to cause the affected rtw89 Wi-Fi hardware or firmware to produce an abnormal TX release report containing an invalid sequence number. When the Linux rtw89_pci driver handles the report during interrupt/NAPI processing, the unvalidated sequence value is used to access the transmit ring page array. If the value points outside the valid range, the driver can dereference a NULL or invalid entry, causing a kernel fault in functions such as rtw89_pci_release_tx and potentially crashing the system. Because the vulnerable code is in the kernel driver and depends on device/firmware behavior, reliable exploitation is likely environment-specific and higher complexity than a typical remotely reachable service bug.

How to fix it

Update to a Linux kernel build that includes the upstream fix validating rpp_info.seq before it is used by the rtw89 PCI driver. If using a distribution kernel, apply the vendor-provided security update rather than manually backporting unless that is the organization’s standard kernel maintenance process. If an immediate kernel update is not possible, reduce exposure by disabling affected rtw89 Wi-Fi hardware where feasible, using wired networking or alternate Wi-Fi hardware/driver paths, blocking automatic loading of the rtw89_pci module on systems that do not require it, and limiting use of affected systems in untrusted wireless environments. No exact fixed package versions were provided in the input, so remediation should be verified against the relevant Linux distribution advisory or upstream stable kernel release notes for this CVE.

How to confirm the fix worked

Confirm exposure by checking whether the system is running Linux with the rtw89_pci module loaded and Realtek rtw89 PCI Wi-Fi hardware present. Validate remediation by confirming the running kernel package includes the patch that validates the TX release report sequence number before indexing wd_ring->pages. After patching and rebooting into the fixed kernel, verify the rtw89_pci module version/build corresponds to the updated kernel and monitor logs for absence of new rtw89_pci_release_tx kernel oops events. Useful checks include reviewing `uname -a`, distribution package changelogs/security advisories, `lsmod | grep rtw89`, `modinfo rtw89_pci`, `lspci -nn` for Realtek wireless adapters, and `journalctl -k` or `/var/log/kern.log` for prior crash signatures.

Typical attack path

1. Identify a Linux system using an affected kernel and Realtek rtw89 PCI Wi-Fi driver.
2. Get within adjacent wireless range or otherwise influence the Wi-Fi device/firmware behavior associated with transmit completion handling.
3. Trigger traffic or device conditions that cause the hardware/firmware to emit a TX release report with an abnormal sequence number.
4. The rtw89_pci driver processes the report and uses the invalid sequence number without adequate bounds validation.
5. The driver accesses outside the expected wd_ring->pages array and hits a NULL pointer dereference in kernel context.
6. The affected system logs a kernel oops and may panic, reboot, or lose Wi-Fi/network availability.

How to detect it

To determine whether this may already have been triggered, review kernel logs, system journals, crash dumps, and reboot history for kernel oops or panic events involving the rtw89_pci driver. Key log sources include `journalctl -k`, `/var/log/kern.log`, `/var/log/messages`, `dmesg`, distribution crash dump directories, kdump/vmcore records, and endpoint telemetry that records kernel panic or unexpected reboot events. Look for call traces containing `rtw89_pci_release_tx`, `rtw89_pci_napi_poll`, `rtw89_pci_interrupt_threadfn`, `net_rx_action`, and NULL pointer dereference messages. Correlate events with Wi-Fi activity, physical location, nearby wireless anomalies, and repeated crashes in the same wireless environment. The available information does not provide a network payload signature or attacker tool artifact; detection is therefore crash-artifact and driver-log based rather than packet-signature based.

• BUG: kernel NULL pointer dereference
• NULL pointer dereference, address: 0000000000000000
• #PF: supervisor read access in kernel mode
• Oops: 0000
• rtw89_pci_release_tx
• rtw89_pci_napi_poll
• rtw89_pci_interrupt_threadfn
• irq/129-rtw89_p
• wd_ring->pages
• rpp_info.seq
• wifi: rtw89: pci
• rtw89_pci
• rtw89_core

What your security team should do

• Inventory Linux endpoints and embedded systems for loaded rtw89/rtw89_pci Wi-Fi drivers and Realtek rtw89 PCI wireless adapters.
• Prioritize kernel updates for systems that rely on Wi-Fi in operationally important locations or operate in untrusted/shared wireless environments.
• Apply vendor kernel updates that include the rtw89 sequence-number validation fix, then reboot into the fixed kernel.
• Where patching is delayed, disable or blacklist rtw89_pci on systems that do not require the affected Wi-Fi hardware.
• Add monitoring for kernel oops/panic messages containing rtw89_pci_release_tx, rtw89_pci_napi_poll, or invalid TX release report behavior.
• Treat repeated unexplained crashes on Wi-Fi-enabled Linux systems as potentially security-relevant, especially if they occur in specific physical locations or around unknown wireless activity.
• Because EPSS is low, unchanged over 30 days, and the issue is not in KEV, handle this through normal high-severity kernel patching workflows unless affected systems have elevated availability requirements.