The rtw89_pci driver in the Linux kernel accesses the wd_ring->pages array without validating the sequence number in the TX release report. When hardware reports an abnormal or missing sequence, the driver dereferences a null or out-of-bounds pointer, causing a kernel NULL-pointer dereference and an oops. This results in a kernel panic that brings the affected host to a halt, effectively denying availability of all services that rely on the kernel.

All Linux kernel builds that include the rtw89_pci driver are potentially affected. No specific kernel release is listed, so any system that has not applied the sequence-validation patch remains at risk.

Based on the description, it is inferred that an attacker would need to deliver a malformed TX release report to the rtw89_pci driver, which in practice means either a fault in the wireless hardware firmware or a physical compromise that can inject such reports. The EPSS score of < 1% indicates a very low exploitation probability, and the vulnerability is not listed in CISA’s KEV catalog. The CVSS score of 7.5 denotes a high‑severity vulnerability. The result of such an event is a kernel NULL-pointer dereference that triggers a crash and denies availability of the affected system.