The rtw88 wireless driver stores an ieee80211_hw pointer using pci_set_drvdata() during probe, but later attempts to retrieve it as a net_device pointer in the AER handlers. This type mismatch causes netif_device_detach/attach to operate on the wrong structure, corrupting memory and leading to a kernel crash. The crash renders the Wi‑Fi stack unusable and can bring the entire system down, resulting in a denial‑of‑service. The flaw demonstrates type confusion (CWE‑843).

The vulnerability is present in any Linux kernel that includes the rtw88 driver before the industrial patch is applied. All distributions shipping a kernel with this driver are potentially impacted. No specific vendor or version list is supplied beyond the generic Linux kernel CPE, meaning every kernel that loads rtw88 could be affected.

The CVSS score of 8.8 reflects a high severity to system stability. The EPSS score of < 1% indicates a very low likelihood of exploitation under normal circumstances. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires an environment that triggers the AER error paths, which typically arise from hardware faults, making it a local, privilege‑related risk. Overall risk is moderate to high for impacted systems that cannot apply the patch in a timely manner.