68 matches found
CVE-2021-32537
CVE-2021-32537: Out-of-bounds access in RTKVHD64 leading to pool corruption. This is a bug that I reported to Realtek beginning of April 2021. The affected driver is named RTKVHD64.sys and seems to be available on a bunch of mainstream hardware tested the below hardware configurations but probabl...
rtl8812au
RTL8812AU/21AU and RTL8814AU linux driver with monitor mode and frame injection The master branch is based on https://github.com/ulli-kroll/rtl8821au branch v4.3.22-beta/rework. According to rtwversion.c the real driver version is 4.3.20. The branch v4.3.21 may be built for RTL8814AU or...
CVE-2026-51585
realtek poc rt26cx21x64.sys exploit Realtek PCIe GbE/2.5GbE/5GbE family Overview OID 0xFF816871 maps the nic's mmio bar into the calling proc's virtual addr space, MmLockedPagesSpecifyCache, reachable from um via \.\RealTekCardGUID This IOCTL 0x0012C818 is gated by a registry value DrvMode=4 Once...
Astra Linux – Vulnerability found in Linux 5.15, Linux 5.10
In the Linux kernel, the following vulnerabilities have been resolved: mmc: rtsxusbsdmmc: Fix the return value check in mmcaddhost. The mmcaddhost function may return an error. If we ignore its return value, the memory allocated by mmcallochost will be leaked, leading to a kernel crash due to the...
Astra Linux – Vulnerability in Linux 5.15
In the Linux kernel, the following vulnerability has been resolved: Staging: r8188eu: prevented -Ssid overflow in rtwwxsetscan This code includes a check to prevent read overflow, but another check is needed to prevent writing beyond the end of the -Ssid array...
CVE-2026-64445 staging: rtl8723bs: fix WEP length underflow and OOB read in OnAuth()
In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix WEP length underflow and OOB read in OnAuth OnAuth has two bugs in the shared-key authentication path. When the Privacy bit is set, rtwwepdecrypt is called without verifying that the frame is long enough t...
The vulnerability of the _dpk_pas_read() function in the drivers/net/wireless/realtek/rtw89/rtw8852a_rfk.c driver for the Realtek wireless connection driver in the Linux operating system allows a hacker to cause a service failure.
The vulnerability of the dpkpasread function in the drivers/net/wireless/realtek/rtw89/rtw8852arfk.c driver for the Realtek wireless adapter in the Linux operating system is related to insufficient validation of input data during division by zero. Exploiting this vulnerability could allow an...
The vulnerability of the rtl92cu_tx_fill_desc() function in the drivers/net/wireless/realtek/rtlwifi/rtl8192cu/trx.c driver module of the Realtek wireless communication adapter driver for the Linux operating system allows a hacker to access protected information or cause a service failure.
The vulnerability of the rtl92cutxfilldesc function in the drivers/net/wireless/realtek/rtlwifi/rtl8192cu/trx.c module of the Realtek wireless adapter driver for the Linux operating system is related to buffer overflow attacks. Exploiting this vulnerability can allow attackers to access protected...
CVE-2026-52982
A flaw was found in the Linux kernel's USB network driver for Realtek RTL8150 devices. A race condition exists in the rtl8150startxmit function, where a network packet's data buffer can be released prematurely. This can lead to a 'use-after-free' vulnerability, allowing the system to attempt to...
Astra Linux – Vulnerability in Linux 5.10
In the Linux kernel, the following vulnerabilities have been resolved: net: dsa: realtek: fixed out-of-bounds access issues The probe function sets priv-chipdata to void priv + sizeofpriv, with the expectation that priv has sufficient trailing space. However, only realtek-smi actually allocated...
The vulnerability of the rtw89_cam_reset_key_iter() function in the driver/net/wireless/realtek/rtw89/cam.c file of the Realtek wireless adapter support driver for the Linux operating system allows a hacker to cause a service failure.
The vulnerability of the rtw89camresetkeyiter function in the drivers/net/wireless/realtek/rtw89/cam.c file of the Realtek wireless adapter support driver for Linux operating systems is related to the improper shutdown or release of resources. Exploiting this vulnerability can allow an attacker t...
PT-2026-37499
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A null dereference issue exists in the find network function within the rtl8723bs staging driver. The variable pwlan can be NULL when passed into the rtw free network nolock function,...
The vulnerability of the rtl8187_rx_cb() function in the driver/net/wireless/realtek/rtl818x/rtl8187/dev.c file of the wireless communication adapter driver from Realtek’s Linux kernel, which allows an attacker to compromise the confidentiality, integrity, and accessibility of protected information.
The vulnerability of the rtl8187rxcb function in the driver/net/wireless/realtek/rtl818x/rtl8187/dev.c file of the wireless communication adapter driver from Realtek’s Linux kernel lies in improper resource cleanup or release. Exploiting this vulnerability could allow an attacker to compromise th...
ROS-20260220-73-0005
A vulnerability in the rtwfwbtwificontrol function of the drivers/net/wireless/realtek/rtw88/coex.c module of the Linux operating system kernel is related to reading data outside buffer boundaries in memory. Exploitation of the vulnerability could allow an attacker to cause a denial of service...
Vulnerability of functions rtw89_core_register_hw() and rtw89pci_probe() in the driver module net/wireless/realtek/rtw89/core.c of the Realtek wireless adapter driver for the Linux operating system. This vulnerability allows a hacker to cause a service failure.
The vulnerability of the functions rtw89coreregisterhw and rtw89pciprobe in the driver module net/wireless/realtek/rtw89/core.c of the Realtek wireless adapter driver in the Linux operating system is related to synchronization errors when using shared resources. Exploiting this vulnerability can...
CVE-2025-71100
In the Linux kernel, the following vulnerability has been resolved: wifi: rtlwifi: 8192cu: fix tid out of range in rtl92cutxfilldesc TID getting from ieee80211gettid might be out of range of array size of staentry-tids, so check TID is less than MAXTIDCOUNT. Othwerwise, UBSAN warn: UBSAN:...
Linux Distros Unpatched Vulnerability : CVE-2023-54065
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net: dsa: realtek: fix out-of-bounds access The probe function sets priv-chipdata to void priv + sizeofpriv with the expectation that priv has enough trailing...
UBUNTU-CVE-2023-54065
In the Linux kernel, the following vulnerability has been resolved: net: dsa: realtek: fix out-of-bounds access The probe function sets priv-chipdata to void priv + sizeofpriv with the expectation that priv has enough trailing space. However, only realtek-smi actually allocated this chipdata spac...
CVE-2023-54065
CWE/Issue: Linux kernel net: dsa: realtek: fix out-of-bounds access in realtek-mdio probe. Root cause (as stated): The probe assigns priv->chip_data to (void *)priv + sizeof(*priv), assuming trailing space is available. Only realtek-smi allocated this space; realtek-mdio did not, risking out-o...
