CVE-2026-43267: Linux Kernel RTW89 WiFi DoS Vulnerability

CVE-2026-43267 Overview

CVE-2026-43267 is a denial-of-service vulnerability in the Linux kernel's rtw89 Wi-Fi driver. Fuzz testing revealed that the bss_conf->beacon_int field can be zero during beacon tracking. Subsequent kernel calculations divide by this value, triggering a division-by-zero error. The fix sets a default of 100 Time Units (TU) when the interval is zero. The patch is committed across stable kernel branches via commits 1260bee, e00c9a4, and eb57be3.

Critical Impact
A malformed beacon frame with a zero beacon interval can trigger a divide-by-zero in the rtw89 driver, leading to a kernel crash and host denial of service.

Affected Products

Linux kernel rtw89 Wi-Fi driver (Realtek 802.11ax chipsets)
Linux stable kernel branches prior to commits 1260bee, e00c9a4, and eb57be3
Systems using Realtek RTW89-supported Wi-Fi adapters in station mode

Discovery Timeline

2026-05-06 - CVE-2026-43267 published to NVD
2026-05-06 - Last updated in NVD database

Technical Details for CVE-2026-43267

Vulnerability Analysis

The rtw89 driver implements beacon tracking for connected Wi-Fi sessions. Beacon tracking relies on bss_conf->beacon_int, the interval between consecutive beacon frames advertised by an access point. The driver consumes this value in time-based calculations that divide by the interval.

Fuzz testing showed the field can hold the value zero. When code paths divide by beacon_int without validation, the kernel triggers a divide error exception. On x86_64 Linux, this results in a kernel oops or panic depending on configuration. The crash occurs in driver context and can disrupt host availability.

The issue falls under the Denial of Service category and stems from improper input validation of network-supplied data.

Root Cause

The root cause is missing validation of bss_conf->beacon_int before arithmetic use. The mac80211 stack populates beacon_int from beacon frame contents and association parameters. The rtw89 driver assumed a non-zero value but did not enforce this assumption. A zero value reaches division operations and faults the CPU.

The upstream fix substitutes 100 TU as the default when the interval is zero. 100 TU is the standard beacon interval in 802.11 networks and provides a safe fallback.

Attack Vector

The attack vector is adjacent network access. An attacker within radio range can transmit crafted beacon or association response frames that lead to a zero beacon_int reaching the driver. The vulnerable code path executes during beacon tracking after a station connects or attempts to connect.

No authentication is required. The result is a kernel crash on the victim host. Code execution is not indicated by the upstream commit description. See the kernel commits 1260bee, e00c9a4, and eb57be3 for the patch details.

Detection Methods for CVE-2026-43267

Indicators of Compromise

Kernel oops or panic logs referencing divide error within rtw89 driver functions
dmesg entries showing call traces in beacon tracking routines after Wi-Fi association
Sudden loss of Wi-Fi connectivity correlated with kernel crash dumps on Realtek RTW89 hardware

Detection Strategies

Monitor /var/log/kern.log and journalctl -k for divide-by-zero exceptions tied to rtw89_* symbols
Inventory hosts running Realtek 802.11ax adapters and confirm running kernel version against patched stable releases
Capture wireless traffic in sensitive areas to identify rogue access points advertising abnormal beacon intervals

Monitoring Recommendations

Forward kernel logs to a centralized logging platform and alert on divide_error and Oops strings
Track Wi-Fi disconnect rates per host to surface anomalous radio environments
Correlate kernel crash telemetry with physical location data to identify targeted radio attacks

How to Mitigate CVE-2026-43267

Immediate Actions Required

Apply the latest Linux stable kernel that includes commits 1260bee, e00c9a4, or eb57be3 for your maintained branch
Identify all systems using rtw89 driver via lsmod | grep rtw89 and prioritize patching
Restrict use of affected hardware in untrusted radio environments until patched

Patch Information

The fix was merged to mainline and backported to stable branches. Reference commits: 1260bee, e00c9a4, and eb57be3. The patch validates bss_conf->beacon_int and assigns 100 TU when it is zero before performing division.

Workarounds

Unload the rtw89 module on affected hosts when patching is not immediately possible: modprobe -r rtw89_pci rtw89_core
Disable Wi-Fi on critical systems and use wired connectivity until the kernel update is deployed
Limit physical proximity exposure by operating affected devices in controlled radio environments

bash

# Verify running kernel and rtw89 module status
uname -r
lsmod | grep rtw89

# Temporarily unload the driver as a workaround
sudo modprobe -r rtw89_pci
sudo modprobe -r rtw89_core

# Block automatic loading until the system is patched
echo 'blacklist rtw89_pci' | sudo tee /etc/modprobe.d/blacklist-rtw89.conf
echo 'blacklist rtw89_core' | sudo tee -a /etc/modprobe.d/blacklist-rtw89.conf