A vulnerability in the Linux kernel’s rtw88 PCIe WiFi driver allows an out‑of‑bounds read when the driver calculates the length of a received packet from firmware descriptors. The driver sums a 14‑bit packet length (max 16383) with a firmware‑controlled offset, which can exceed the 11478‑byte DMA buffer. This overflow lets the driver copy bytes beyond the buffer, potentially exposing kernel memory contents or causing the kernel to crash. If an attacker can subtly manipulate the firmware descriptor values, they may induce the driver to read privileged memory or trigger a denial‑of‑service. The available fix adds a bounds check to prevent the overflow. Based on the description, it is inferred that an attacker would need local control over the PCIe WiFi adapter to forge descriptor values that cause the overflow.

The flaw affects any Linux kernel build that includes the rtw88 driver for PCIe WiFi adapters before the patch commit. All distributions using older kernel versions that include the vulnerable driver code are impacted. The issue is not tied to a specific kernel release number but to the presence of the unpatched code path in rtw88.

The CVSS score of 8.1 marks it as high severity, but the very low EPSS score indicates a low probability that the vulnerability will be actively exploited in the wild. The flaw is not currently listed in the CISA KEV catalog. Exploitation would most likely require local access to the PCIe WiFi adapter and the ability to influence the firmware descriptor. Based on the description, it is inferred that the attack vector is local, requiring the attacker to manipulate the firmware descriptor through the PCIe interface. No remote exploitation is documented. The commit that added the bounds check eliminates the out‑of‑bounds read, but until the patch is applied the kernel remains vulnerable under these conditions.