A NULL pointer dereference occurs in rtw_fw_adaptivity_result() of the Realtek rtw88 Wi‑Fi driver. The function attempts to access rtwdev->chip->edcca_th without checking for NULL. Devices with the 8821CE chip leave edcca_th unset; when the driver dereferences this pointer the kernel triggers an oops and crashes. The result is a kernel panic that may force the system to reboot, causing a denial of service. The weakness corresponds to a null pointer dereference (CWE‑476).

The vulnerability affects the Linux kernel's rtw88 Wi‑Fi driver when deployed on devices that use the Realtek 8821CE chip. All distributions that ship the kernel with this driver and contain that chip model are potentially impacted. No specific kernel or distribution versions are listed, so all kernel releases that include the rtw88 driver and the 8821CE chip definition are in scope.

The severity is moderate with a CVSS score of 5.5, indicating a medium-level risk. The attack vector is inferred from the description and is likely local or device‑level, requiring the attacker to cause the driver to process malicious or malformed Wi‑Fi frames or firmware inputs that trigger the dereference. There is no evidence of remote code execution or privilege escalation. The EPSS score is < 1%, and the vulnerability is not yet listed in the CISA KEV catalog, indicating no publicly known exploitation, but the lack of checks creates a clear crash pathway. Managers should treat it as a potential denial‑of‑service risk until an update is deployed.