The rtw89 driver in the Linux kernel does not verify the length of a PHY status information element before parsing it. A WiFi adapter that supplies an element of unexpected length can cause the driver to read beyond the bounds of the supplied buffer, potentially leading to a kernel crash or the leakage of sensitive data. The flaw resides in an uncontrolled input handling path within driver code.

All Linux deployments that include the rtw89 driver without the recent commit correcting the length check are affected. This includes kernel versions that retain the buggy code and are in use on systems with WiFi adapters that use the rtw89 stack. No specific distribution or version numbers are listed, so any kernel built before the fix will be vulnerable.

An attacker who can send crafted radio frames to the vulnerable adapter, or who has physical access to the device, could trigger the out‑of‑bounds read. The vulnerability can manifest as a kernel panic, causing a denial of service, or may expose kernel memory contents, leading to potential information leakage. The CVSS score is 5.5 and the EPSS score is < 1%; the flaw is not listed in the CISA KEV catalog.