The rtw89_pci driver in the Linux kernel accesses the wd_ring->pages array without validating the sequence number in the TX release report. When the hardware reports an abnormal or missing sequence, the driver dereferences a null or out‑of‑bounds pointer, causing a kernel NULL‑pointer dereference and an oops. This results in a kernel panic that brings the affected host to a halt, effectively denying availability of all services that rely on the kernel.

All Linux kernel builds that include the rtw89_pci driver are potentially affected. No specific kernel release is listed, so any system that has not applied the sequence‑validation patch remains at risk.

Exploitation would require the ability to deliver a malformed TX release report to the rtw89_pci driver, which in practice means either a fault in the wireless hardware firmware or a physical compromise that can inject such reports. The EPSS score is not provided and the vulnerability is not in the CISA KEV catalog. Given that a kernel crash is a severe outcome, the risk is considered moderate to high for environments that cannot immediately patch.