CVE-2026-97500: wifi: rtw89: phy: check length before parsing PHY status IE
In the Linux kernel, the following vulnerability has been resolved:
wifi: rtw89: phy: check length before parsing PHY status IE
Hardware might report PHY status IE with unexpected length, and parser might access out of range. Check the length ahead.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Check the length of the PHY status information element (IE) before parsing it in the Linux kernel rtw89 PHY handler.
Event History
Frequently Asked Questions
Which systems are relevant to this issue?
Linux kernel systems using the rtw89 Wi-Fi driver are relevant. The condition occurs when hardware reports a PHY status information element with an unexpected length.
Is an attacker-controlled trigger or remote exploitation path documented?
No. The available information identifies unexpected hardware-reported PHY status length as the trigger, but does not state whether an attacker can induce it or exploit it remotely.
What should be done if the system may be affected?
Apply a Linux kernel update containing the referenced fix. The fix validates the PHY status information element length before parsing it, preventing out-of-range parser access.