rootpwn

medium · CVSS v3 5.5

CVE-2026-93281

A buffer over-read in the Realtek rtw89 Wi‑Fi driver allows reading beyond the intended data length. The flaw occurs when the driver process

Overview

A buffer over-read in the Realtek rtw89 Wi‑Fi driver allows reading beyond the intended data length. The flaw occurs when the driver processes HE extended capabilities with insufficient length checks. This can lead to information disclosure or kernel crashes on affected systems.

Description

In the Linux kernel, the following vulnerability has been resolved: wifi: rtw89: fix HE extended capability length check rtw89_mac_check_he_obss_narrow_bw_ru_iter() reads extended capability byte 10, but rejects only datalen values below 10. Byte 10 requires at least 11 bytes. Require datalen >= 11 before reading data[10].

Impact

The vulnerability can expose sensitive data from the wireless stack and may trigger a kernel panic, causing a denial of service. It affects Linux systems using Realtek rtw89 adapters, potentially compromising confidentiality and availability. Attackers could exploit rogue Wi‑Fi networks to trigger the flaw. Defenders should be aware of the risk to network stability and data integrity.

Remediation

Apply the official kernel patch that enforces a minimum data length of 11 bytes before accessing byte 10. Update the Realtek rtw89 driver to the latest version or upgrade the kernel to a patched release. As a temporary mitigation, disable Wi‑Fi or block untrusted APs while awaiting the patch. Monitor system logs for kernel panics or abnormal Wi‑Fi activity.

Risk context

The CVE has a medium severity rating (CVSS 5.5) and no EPSS data is available. While not critical, the flaw can cause crashes or data leaks, warranting timely patching. Defenders should treat it as a moderate risk that requires prompt attention.

Affected products

  • Linux kernel
  • Realtek rtw89 driver
  • Realtek 8852
  • Realtek 8852E
  • Realtek 8852C
  • Realtek 8852D
  • Realtek 8852F
  • Realtek 8852G

Scores

Severity
medium
CVSS v2
5
CVSS v3
5.5
CVSS v4
—
EPSS
—

kernel wifi rtw89 information-disclosure denial-of-service Realtek medium patch

← All CVEs

Related CVEs

medium

CVE-2026-97058

sprintf-js 1.1.3 allows attackers to inject unbounded precision specifiers that trigger RangeError exceptions, causing application crashes. The flaw is triggered by malicious format strings and can be exploited in any Node.js or JavaScript environment that uses the library. It is a medium‑severity issue that can lead to denial of service.

View analysis

medium

CVE-2026-97061

Black Candy through 3.2.1 fails to scope playlist search queries to the authenticated session user, allowing any authenticated user to enumerate all playlists on the instance. Attackers can query the SearchController or Search::PlaylistsController endpoints with blank or targeted search parameters to retrieve playlist names belonging to other users without authorization.

View analysis

medium

CVE-2026-97062

Aureus ERP through 1.6.0 stores uploaded SVG files on its public disk and serves them from the application origin, allowing authenticated users to upload malicious SVG files containing JavaScript. Attackers can craft SVG files with script elements that execute in the application's origin when the file URL is opened directly, enabling session cookie theft and CSRF token exfiltration.

View analysis

medium

CVE-2026-97176

A flaw was found in the Level of Authentication enforcement mechanism of Keycloak, an identity and access management solution. The issue occurs when a client specifically requires a higher security level for a user who already has an active session at a lower level. Due to a logic error in how session re-evaluations are handled, Keycloak may incorrectly issue a token at the lower security level instead of enforcing the required higher level, potentially allowing unauthorized access to sensitive resources that rely on these security claims.

View analysis