CVE-2022-49471

A flaw was found in the Linux kernel's Realtek wireless driver (rtw89). This vulnerability allows a Denial of Service (DoS) or potential kernel memory disclosure due to an out-of-bounds array access. The driver fails to validate the station identifier before using it as an index into an internal array during packet processing. An attacker within wireless network range could exploit this issue by transmitting malformed wireless traffic, resulting in memory corruption and a system crash.

This vulnerability is evaluated as Moderate severity because exploitation is contingent on the host having compatible Realtek rtw89 wireless hardware, which is rarely deployed in standard enterprise environments. Although malformed over-the-air frames can trigger an out-of-bounds array access leading to a kernel crash or memory disclosure, the attack surface is limited to systems operating these specific Wi-Fi adapters within physical radio range. Standard enterprise installations without this hardware or with wireless networking disabled are not exposed to this flaw.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.