The rtw89 Wi‑Fi driver includes an insufficient length check for Host Embedded (HE) extended capabilities. The routine reads byte 10 of a data buffer that may be shorter than expected, while only verifying that the received length is less than 10. If an attacker sends a packet whose length is between 10 and 11 inclusive, the driver will read past the buffer’s end, resulting in an out‑of‑bounds read. This condition can cause a kernel crash or expose sensitive memory contents, ultimately denying service to the network interface or the entire host.

Any Linux system that ships the rtw89 driver without the patch commit that introduces a datalen‑>=11 guard is vulnerable. The affected versions are not explicitly listed; consequently all kernel releases prior to the fix commit are potential targets. The vulnerability is confined to machines with active rtw89 Wi‑Fi chipsets that process HE extended capability frames.

Exploitation requires only the ability to transmit a crafted HE frame over the air, making the attack vector remote and easily achievable by any nearby adversary with a Wi‑Fi transmitter. The CVSS score of 5.5 indicates moderate severity, while the EPSS of < 1% suggests a low likelihood of widespread exploitation at present. The vulnerability is not catalogued in CISA KEV. Nevertheless, an out‑of‑bounds read could cause a kernel panic, rendering the device inoperable or available for denial‑of‑service attacks.