CVE-2026-93281

A flaw was found in the Linux kernel's Realtek Wi-Fi driver (rtw89). This vulnerability may allow an attacker within wireless range to cause a Denial of Service (DoS) via a system crash. By transmitting a crafted wireless frame with malformed capability information, an attacker can trigger an improper length check leading to an out-of-bounds memory read.

A moderate out-of-bounds read flaw was found in the Linux kernel's Realtek rtw89 wireless driver. When processing a received 802.11 management frame containing an HE (802.11ax) Extended Capabilities element, rtw89_mac_check_he_obss_narrow_bw_ru_iter() validated only that the element data length was at least 10 bytes before reading data byte 10, which requires at least 11 bytes. An unauthenticated attacker within Wi-Fi radio range of a system using Realtek rtw89 hardware could send a crafted frame with a truncated Extended Capabilities element to trigger this one-byte out-of-bounds read, resulting in incorrect capability handling and potentially a kernel panic and denial of service. The out-of-bounds value is used only in an internal check, so no confidentiality or integrity impact is expected.

The vulnerable rtw89 driver code is present in Red Hat Enterprise Linux 8, 9 and 10 (including the kernel-rt variant), RHEL Automotive, and the kernels of affected Red Hat OpenShift 4 releases; the fix is currently deferred for these streams because the flaw is an out-of-bounds read with no demonstrated privilege escalation, memory disclosure, or write primitive, limiting the residual risk mainly to a possible denial of service against systems with Realtek rtw89 Wi-Fi hardware within an attacker's radio range. RHEL 6, RHEL 7, the RHEL 8.4 and 8.6 z-stream kernels, and the OpenShift 4.12 kernel are not affected because the vulnerable code is not present in those streams. Red Hat has rated this flaw as Moderate severity.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.