The Linux kernel driver for Realtek rtw89 networking hardware contains a type mismatch in the advanced error recovery (AER) handlers. At probe time the driver stores a pointer to an ieee80211_hw structure using pci_set_drvdata, but the io_error_detected() and io_resume() functions incorrectly interpret this pointer as a net_device structure. When netif_device_detach/attach are then called, they operate on the wrong data type, writing and reading at offsets that belong to an ieee80211_hw, which corrupts kernel memory. This fault can trigger a kernel panic or other critical failures when the AER paths are exercised.

All Linux kernel builds that include the rtw89 driver for Realtek 8852C‑type Wi‑Fi adapters are affected. No specific kernel versions were enumerated, so any release that predates the patch commit (7068c379cf9aa8afe4dce4d9d82390187aa9c4d0) should be considered vulnerable until updated.

The fault leads to memory corruption that can result in a kernel crash, effectively causing a denial of service. The CVSS score is 8.8, indicating high severity. Since the AER handlers can be triggered by normal adapter error events, an attacker with local access to the affected device could force the kernel to crash. The EPSS score of < 1% indicates a very low probability of exploitation, and the vulnerability is not listed in CISA KEV. Based on the description, it is inferred that the attack vector is local and depends on the kernel’s handling of Wi‑Fi error events.