The Linux kernel Wi‑Fi driver rtw89 contains a logic error in the 6GHz band scan routine. During a 6GHz scan the counter used for the channel list is incorrectly typed, causing the counter to overflow into a large value. The kernel then enters an infinite loop in rtw89_hw_scan_add_chan_ax, producing a soft lockup that stalls a CPU core for over 20 seconds. If the lockup persists the system panics, effectively causing a denial‑of‑service that halts all operations until a reboot.

Every Linux system that includes the rtw89 driver for 802.11ax 6GHz operation, regardless of distribution, is affected. The flaw exists in the kernel's wireless stack and applies to any installation that compiles the current kernel source without the patch.

The CVSS score of 8.8 reflects a high severity, while the EPSS score of <1% indicates a low probability of exploitation. The vulnerability is triggered by initiating a 6GHz Wi‑Fi scan, which can be performed by user‑space utilities with standard network‑administration privileges, making it a local or privileged attack vector. Remote exploitation is unlikely because the fault resides entirely in kernel code that is not directly exposed to external traffic. The issue is not listed in CISA's KEV catalog, suggesting no widespread exploitation has been observed. Nevertheless, the denial‑of‑service impact warrants prompt action.